summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/basic/bigLoadStoreDisp.js
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /js/src/jit-test/tests/basic/bigLoadStoreDisp.js
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'js/src/jit-test/tests/basic/bigLoadStoreDisp.js')
-rw-r--r--js/src/jit-test/tests/basic/bigLoadStoreDisp.js25
1 files changed, 25 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bigLoadStoreDisp.js b/js/src/jit-test/tests/basic/bigLoadStoreDisp.js
new file mode 100644
index 000000000..4f0df8155
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bigLoadStoreDisp.js
@@ -0,0 +1,25 @@
+// In Nanojit, loads and stores have a maximum displacement of 16-bits. Any
+// displacements larger than that should be split off into a separate
+// instruction that adds the displacement to the base pointer. This
+// program tests if this is done correctly.
+//
+// x.y ends up having a dslot offset of 79988, because of the 20000 array
+// elements before it. If Nanojit incorrectly stores this offset into a
+// 16-bit value it will truncate to 14452 (because 79988 - 65536 == 14452).
+// This means that the increments in the second loop will be done to one of
+// the array elements instead of x.y. And so x.y's final value will be
+// (99 + 8) instead of 1099.
+//
+// Note that setting x.y to 99 and checking its value at the end will
+// access the correct location because those lines are interpreted. Phew.
+
+var x = {}
+for (var i = 0; i < 20000; i++)
+ x[i] = 0;
+x.y = 99; // not traced, correctly accessed
+
+for (var i = 0; i < 1000; ++i) {
+ x.y++; // traced, will access an array elem if disp was truncated
+}
+assertEq(x.y, 1099); // not traced, correctly accessed
+