1 files changed, 51 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/recover-object-bug1175233.js b/js/src/jit-test/tests/ion/recover-object-bug1175233.js
new file mode 100644
index 0000000000..6d4a8eaa5b
--- /dev/null
+++ b/js/src/jit-test/tests/ion/recover-object-bug1175233.js
@@ -0,0 +1,51 @@
+// |jit-test| --ion-pruning=on
+//
+// Unboxed object optimization might not trigger in all cases, thus we ensure
+// that Scalar Replacement optimization is working well independently of the
+// object representation.
+
+// Ion eager fails the test below because we have not yet created any
+// template object in baseline before running the content of the top-level
+// function.
+if (getJitCompilerOptions()["ion.warmup.trigger"] <= 130)
+    setJitCompilerOption("ion.warmup.trigger", 130);
+
+// This test checks that we are able to remove the getelem & setelem with scalar
+// replacement, so we should not force inline caches, as this would skip the
+// generation of getelem & setelem instructions.
+if (getJitCompilerOptions()["ion.forceinlineCaches"])
+    setJitCompilerOption("ion.forceinlineCaches", 0);
+
+// Prevent the GC from cancelling Ion compilations, when we expect them to succeed
+gczeal(0);
+
+var uceFault = function (j) {
+    if (j >= max)
+        uceFault = function (j) { return true; };
+    return false;
+}
+
+function f(j) {
+    var i = Math.pow(2, j) | 0;
+    var obj = {
+      i: i,
+      v: i + i
+    };
+    // These can only be recovered on bailout iff either we have type
+    // information for the property access in the branch, or the branch is
+    // removed before scalar replacement.
+    assertRecoveredOnBailout(obj, true);
+    assertRecoveredOnBailout(obj.v, true);
+    if (uceFault(j) || uceFault(j)) {
+        // MObjectState::recover should neither fail,
+        // nor coerce its result to an int32.
+        assertEq(obj.v, 2 * i);
+    }
+    return 2 * obj.i;
+}
+
+var max = 150;
+for (var j = 0; j <= max; ++j) {
+    with({}){};
+    f(j);
+}