summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/auto-regress/bug1448582-1.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/auto-regress/bug1448582-1.js')
-rw-r--r--js/src/jit-test/tests/auto-regress/bug1448582-1.js21
1 files changed, 21 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/auto-regress/bug1448582-1.js b/js/src/jit-test/tests/auto-regress/bug1448582-1.js
new file mode 100644
index 0000000000..28f2e3ea9f
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1448582-1.js
@@ -0,0 +1,21 @@
+// Overview:
+// - The outer function is an IIFE which gets marked as a singleton.
+// - The |o[index]| inner function is then also marked as a singleton.
+// - The |o[index]| inner function has a dynamic name from a computed property name.
+// - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
+//
+// When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
+// function which triggered an assertion in js::SetFunctionNameIfNoOwnName().
+
+(function(index) {
+ var o = {
+ [index]: function() {}
+ };
+
+ // Reinvoke the IIFE through |Function.prototype.caller|.
+ if (index === 0) {
+ (function self() {
+ self.caller(1);
+ })();
+ }
+})(0);