diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/tests/non262/regress/regress-452498-053.js | |
parent | Initial commit. (diff) | |
download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | js/src/tests/non262/regress/regress-452498-053.js | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/js/src/tests/non262/regress/regress-452498-053.js b/js/src/tests/non262/regress/regress-452498-053.js new file mode 100644 index 0000000000..749e53e0cd --- /dev/null +++ b/js/src/tests/non262/regress/regress-452498-053.js @@ -0,0 +1,77 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* + * Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/licenses/publicdomain/ + * Contributor: Jason Orendorff + */ + +//----------------------------------------------------------------------------- +var BUGNUMBER = 452498; +var summary = 'TM: upvar2 regression tests'; +var actual = ''; +var expect = ''; + + +//----------------------------------------------------------------------------- +test(); +//----------------------------------------------------------------------------- + +function test() +{ + printBugNumber(BUGNUMBER); + printStatus (summary); + +// ------- Comment #53 From Jason Orendorff + +// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1] +// at ../jsobj.cpp:5559 +// On the last line of BindLet, we have +// JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn)); +// but this uses reserved slots as though they were unlimited. +// blockObj only has 2. + { let a=0, b=1, c=2; } + +// In RecycleTree at ../jsparse.cpp:315, we hit +// MOZ_CRASH("RecycleUseDefKids"); +// pn->pn_type is TOK_UNARYOP +// pn->pn_op is JSOP_XMLNAME +// pn->pn_defn is 1 +// pn->pn_used is 1 + try + { + true; 0; + } + catch(ex) + { + } +// Calls LinkUseToDef with pn->pn_defn == 1. +// +// If you say "var x;" first, then run this case, it gets further, +// crashing in NoteLValue like the first case in comment 52. +// + try + { + for (var [x] in y) var x; + } + catch(ex) + { + } +// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461 +// Another case where some optimization is going on. + try + { + if (true && foo) ; + } + catch(ex) + { + } +// Assertion failure: scope->object == ctor +// in js_FastNewObject at ../jsbuiltins.cpp:237 +// +// With the patch, we're new-ing a different function each time, and the +// .prototype property is missing. +// + for (var z = 0; z < 3; z++) { (new function(){}); } + + reportCompare(expect, actual, summary); +} |