From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 21:33:14 +0200 Subject: Adding upstream version 115.7.0esr. Signed-off-by: Daniel Baumann --- js/src/jit-test/tests/ion/bug706692.js | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 js/src/jit-test/tests/ion/bug706692.js (limited to 'js/src/jit-test/tests/ion/bug706692.js') diff --git a/js/src/jit-test/tests/ion/bug706692.js b/js/src/jit-test/tests/ion/bug706692.js new file mode 100644 index 0000000000..d302545903 --- /dev/null +++ b/js/src/jit-test/tests/ion/bug706692.js @@ -0,0 +1,21 @@ +// |jit-test| error: TypeError + +// Bailout from a stack with multiple ion frames of different flavors. +function f(obj,b,c) { + return obj(); // Throw error. +} + +function g(f,obj) { + return f(obj); // Call f() with insufficient arguments, generating a RectifierFrame. +} + +function h(f, g, obj) { + return g(f, obj); // EntryFrame. Generate a JSFrame. +} + +f(); // Prime f(). +g(); // Prime g(). +var obj = new Object(); + +h(f,g,obj); + -- cgit v1.2.3