summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/arguments/inline-arguments-oob-negative-index-1.js
blob: b60140b3a6e040cc4100d5e7f035b831efa7153f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
// |jit-test| --fast-warmup

function inner(i) {
  // Can't be eliminated because negative indices cause a bailout.
  arguments[i];
  arguments[i];
  arguments[i];
}

function outer(i) {
  trialInline();

  // Loop header to trigger OSR.
  for (let j = 0; j < 1; ++j) {
    inner(i,
      // Add extra arguments to ensure we read the arguments from the frame.
      0, 0, 0, 0,
      0, 0, 0, 0,
      0, 0, 0, 0,
      0, 0, 0, 0,
      0, 0, 0, 0,
    );
  }
}

let count = 0;

for (let i = 0; i <= 100; ++i) {
    if (i === 50) {
      Object.defineProperty(Object.prototype, -1, {
        get() {
          count++;
        }
      });
    }
    outer(i < 100 ? i : -1);
}

assertEq(count, 3);