Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 55 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-writable-length.js b/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-writable-length.js
new file mode 100644
index 0000000000..468976332f
--- /dev/null
+++ b/js/src/jit-test/tests/cacheir/store-dense-element-hole-non-writable-length.js
@@ -0,0 +1,55 @@
+// Store an element into a previous hole value and later add more elements
+// exceeding the initialised length. Cover both mono- and polymorphic call
+// sites. Change array length to non-writable during execution.
+
+function testStoreDenseHole() {
+  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
+
+  function store(ar, index) {
+    ar[index] = index;
+  }
+
+  for (var i = 0; i < 10; ++i) {
+    if (i === 5) {
+      Object.defineProperty(array, "length", {writable: false});
+    }
+    store(array, i);
+  }
+
+  assertEq(array.length, 5);
+  for (var i = 0; i < 5; ++i) {
+    assertEq(array[i], i);
+  }
+  for (var i = 5; i < 10; ++i) {
+    assertEq(i in array, false);
+  }
+}
+testStoreDenseHole();
+
+function testStoreDenseHolePoly() {
+  var array = [/* hole */, /* hole */, /* hole */, /* hole */, ];
+
+  function store(ar, index) {
+    ar[index] = index;
+  }
+
+  var objects = [array, {}];
+
+  for (var i = 0; i < 10; ++i) {
+    if (i === 5) {
+      Object.defineProperty(array, "length", {writable: false});
+    }
+    for (var j = 0; j < objects.length; ++j) {
+      store(objects[j], i);
+    }
+  }
+
+  assertEq(array.length, 5);
+  for (var i = 0; i < 5; ++i) {
+    assertEq(array[i], i);
+  }
+  for (var i = 5; i < 10; ++i) {
+    assertEq(i in array, false);
+  }
+}
+testStoreDenseHolePoly();