Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 36 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/basic/shape-teleporting-transplant-1.js b/js/src/jit-test/tests/basic/shape-teleporting-transplant-1.js
new file mode 100644
index 0000000000..889fcaf7b0
--- /dev/null
+++ b/js/src/jit-test/tests/basic/shape-teleporting-transplant-1.js
@@ -0,0 +1,36 @@
+// Test for invalidating shape teleporting when transplanting objects on proto
+// chains.
+
+function checkGetProp(obj, expected) {
+    for (var i = 0; i < 50; i++) {
+        assertEq(obj.prop, expected);
+    }
+}
+
+Object.prototype.prop = 1234;
+
+// Construct the following proto chain:
+//
+//   receiver => protoA (FakeDOMObject) => protoB {prop: 567} => null
+const protoB = Object.create(null);
+protoB.prop = 567;
+const protoA = new FakeDOMObject();
+Object.setPrototypeOf(protoA, protoB);
+const receiver = Object.create(protoA);
+
+// Ensure all objects we allocated are tenured. This way we don't need to trigger
+// a GC later in TransplantableObject, which makes the test more reliable.
+gc();
+
+// Attach an IC for `receiver.prop`.
+checkGetProp(receiver, 567);
+
+// Swap protoA with another object. This must invalidate shape teleporting,
+// because the proto chain of `receiver` now looks like this:
+//
+//   receiver => protoA (new FakeDOMObject) => FakeDOMObject.prototype => Object.prototype => null
+const {transplant} = transplantableObject({object: protoA});
+transplant(this);
+
+// `receiver.prop` now gets `prop` from Object.prototype.
+checkGetProp(receiver, 1234);