diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/jit-test/tests/ion/recover-object-bug1175233.js | |
parent | Initial commit. (diff) | |
download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | js/src/jit-test/tests/ion/recover-object-bug1175233.js | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/recover-object-bug1175233.js b/js/src/jit-test/tests/ion/recover-object-bug1175233.js new file mode 100644 index 0000000000..6d4a8eaa5b --- /dev/null +++ b/js/src/jit-test/tests/ion/recover-object-bug1175233.js @@ -0,0 +1,51 @@ +// |jit-test| --ion-pruning=on +// +// Unboxed object optimization might not trigger in all cases, thus we ensure +// that Scalar Replacement optimization is working well independently of the +// object representation. + +// Ion eager fails the test below because we have not yet created any +// template object in baseline before running the content of the top-level +// function. +if (getJitCompilerOptions()["ion.warmup.trigger"] <= 130) + setJitCompilerOption("ion.warmup.trigger", 130); + +// This test checks that we are able to remove the getelem & setelem with scalar +// replacement, so we should not force inline caches, as this would skip the +// generation of getelem & setelem instructions. +if (getJitCompilerOptions()["ion.forceinlineCaches"]) + setJitCompilerOption("ion.forceinlineCaches", 0); + +// Prevent the GC from cancelling Ion compilations, when we expect them to succeed +gczeal(0); + +var uceFault = function (j) { + if (j >= max) + uceFault = function (j) { return true; }; + return false; +} + +function f(j) { + var i = Math.pow(2, j) | 0; + var obj = { + i: i, + v: i + i + }; + // These can only be recovered on bailout iff either we have type + // information for the property access in the branch, or the branch is + // removed before scalar replacement. + assertRecoveredOnBailout(obj, true); + assertRecoveredOnBailout(obj.v, true); + if (uceFault(j) || uceFault(j)) { + // MObjectState::recover should neither fail, + // nor coerce its result to an int32. + assertEq(obj.v, 2 * i); + } + return 2 * obj.i; +} + +var max = 150; +for (var j = 0; j <= max; ++j) { + with({}){}; + f(j); +} |