js/src/jit-test/tests/ion/result-type-mutated.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

// jitcode which uses objects of one type might not be invalidated when that
// object changes type, if the object isn't accessed in any way.

function foo(x) {
    return x.f;
}

function bar() {
    with({}){}

    var a = {};
    var b = { f: a };
    foo(b);
    a.__proto__ = null;
    foo(b);
}

bar();