summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/basic/bug504587-1.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/basic/bug504587-1.js')
-rw-r--r--js/src/jit-test/tests/basic/bug504587-1.js13
1 files changed, 13 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/bug504587-1.js b/js/src/jit-test/tests/basic/bug504587-1.js
new file mode 100644
index 000000000..a489f99ca
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug504587-1.js
@@ -0,0 +1,13 @@
+// This test case failed a WIP patch. See https://bugzilla.mozilla.org/show_bug.cgi?id=504587#c68
+
+function B() {}
+B.prototype.x = 1;
+var d = new B;
+
+var names = ['z', 'z', 'z', 'z', 'z', 'z', 'z', 'x'];
+for (var i = 0; i < names.length; i++) {
+ x = d.x; // guard on shapeOf(d)
+ d[names[i]] = 2; // unpredicted shape change
+ y = d.x; // guard here is elided
+}
+assertEq(y, 2); // Assertion failed: got 1, expected 2