Add m-esr52 at 52.6.0

1 files changed, 23 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/TypedObject/bug950458.js b/js/src/jit-test/tests/TypedObject/bug950458.js
new file mode 100644
index 000000000..7c90c7bcc
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug950458.js
@@ -0,0 +1,23 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+// Test for fuzz condition failure. Cause of the failure
+// was that we were not adding a type barrier after the
+// creation of derived typed objects. When run in --ion-eager
+// mode, arr[i] (below) would yield a derived typed object
+// with an empty type set, which would then fail sanity
+// checking assertions.
+//
+// Public domain.
+
+var N = 100;
+var T = TypedObject;
+var Point = new T.StructType({x: T.uint32, y: T.uint32, z: T.uint32});
+var PointArray = Point.array(N);
+function foo(arr) {
+  var sum = 0;
+  for (var i = 0; i < N; i++) {
+    sum += arr[i].x + arr[i].y + arr[i].z;
+  }
+}
+foo(new PointArray());