diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/jit-test/tests/ion/recover-lambdas-bug1113940.js | |
parent | Initial commit. (diff) | |
download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | js/src/jit-test/tests/ion/recover-lambdas-bug1113940.js | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/recover-lambdas-bug1113940.js b/js/src/jit-test/tests/ion/recover-lambdas-bug1113940.js new file mode 100644 index 0000000000..078e51ad2c --- /dev/null +++ b/js/src/jit-test/tests/ion/recover-lambdas-bug1113940.js @@ -0,0 +1,37 @@ + +gczeal(14); + +// The object metadata callback can iterate over the stack. Thus during the +// allocation of the lambda we might inspect the stack which is still incomplete +// because the lambda is not yet reconstructed. +// +// enableShellAllocationMetadataBuilder ignores its argument, because we don't +// permit metadata callbacks to run JS any more, so this test may be +// unnecessary. We'll preserve its structure just in case. +enableShellAllocationMetadataBuilder(function() {}); +function f() { + (function() { + '' ^ Object + })(); +} +x = 0; +for (var j = 0; j < 99; ++j) { + x += f(); +} + +try { + x = true; + // Same comment as above. + enableShellAllocationMetadataBuilder(function([x, y, z], ... Debugger) {}); + for (var i = 0; i < 10; ++i) { + var f = function() { + function g() { + x++; + } + g(); + } + f(); + } +} catch (e) { + assertEq(e instanceof TypeError, true); +} |