Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 39 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/ion/spreadcall-not-optimized-dynamic-4b.js b/js/src/jit-test/tests/ion/spreadcall-not-optimized-dynamic-4b.js
new file mode 100644
index 0000000000..f533c39f3f
--- /dev/null
+++ b/js/src/jit-test/tests/ion/spreadcall-not-optimized-dynamic-4b.js
@@ -0,0 +1,39 @@
+// Tests when JSOP_OPTIMIZE_SPREADCALL no longer apply after the initial Ion
+// compilation.
+
+// JSOP_OPTIMIZE_SPREADCALL can be optimised when the following conditions
+// are fulfilled:
+//   (1) the argument is an array
+//   (2) the array has no hole
+//   (3) array[@@iterator] is not modified
+//   (4) the array's prototype is Array.prototype
+//   (5) Array.prototype[@@iterator] is not modified
+//   (6) %ArrayIteratorPrototype%.next is not modified
+
+function add(a, b) {
+    return a + b;
+}
+
+// The rest argument's prototype isn't Array.prototype.
+function test() {
+    class MyArray extends Array { }
+    function maybeInvalidate(rest) {
+        // Use a WithStatement to prevent Ion-inlining. This ensures any
+        // bailouts due to type changes don't occur in this function, but
+        // instead in the caller.
+        with ({});
+
+        if (i >= 1900) {
+            rest = new MyArray(3, 4);
+        }
+        return rest;
+    }
+    function fn(...rest) {
+        rest = maybeInvalidate(rest);
+        return add(...rest);
+    }
+    for (var i = 0; i < 4000; ++i) {
+        assertEq(fn(1, 2), i < 1900 ? 3 : 7);
+    }
+}
+test();