From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 js/src/jit-test/tests/ion/lexical-check-6.js | 39 ++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 js/src/jit-test/tests/ion/lexical-check-6.js

(limited to 'js/src/jit-test/tests/ion/lexical-check-6.js')

diff --git a/js/src/jit-test/tests/ion/lexical-check-6.js b/js/src/jit-test/tests/ion/lexical-check-6.js
new file mode 100644
index 0000000000..5af7686aee
--- /dev/null
+++ b/js/src/jit-test/tests/ion/lexical-check-6.js
@@ -0,0 +1,39 @@
+// This function uses UCE to test when the if branch is removed by
+// IonMonkey.  Some optimization such as Scalar Replacement are able to remove
+// the scope chain, which can cause issues when the scope chain properties are
+// not initialized properly.
+var uceFault = function (i) {
+    if (i % 1500 == 0) {
+        uceFault = function (i) { return i % 1500 == 0; };
+    }
+    return false;
+};
+
+function f(i) {
+    if (uceFault(i) || uceFault(i))
+        g();
+    const x = 42;
+    function g() {
+        return x;
+    }
+    return g;
+}
+
+function loop() {
+    for (; i < 4000; i++)
+        assertEq(f(i)(), 42);
+}
+
+var caught = 0;
+var i = 1;
+while (i < 4000) {
+    try {
+        loop();
+    } catch(e) {
+        assertEq(e instanceof ReferenceError, true);
+        assertEq(i == 1500 || i == 3000, true);
+        caught += 1;
+        i++;
+    }
+}
+assertEq(caught, 2);
-- 
cgit v1.2.3