summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js')
-rw-r--r--js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js31
1 files changed, 31 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js
new file mode 100644
index 000000000..87939ef99
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack.js
@@ -0,0 +1,31 @@
+function loop(f, expected) {
+ // This is the loop that breaks us.
+ // At record time, f's parent is a Call object with no fp.
+ // At second execute time, it is a Call object with fp,
+ // and all the Call object's dslots are still JSVAL_VOID.
+ for (var i = 0; i < 9; i++)
+ assertEq(f(), expected);
+}
+
+function C(bad) {
+ var x = bad;
+ function f() {
+ return x; // We trick TR::callProp() into emitting code that gets
+ // JSVAL_VOID (from the Call object's dslots)
+ // rather than the actual value (true or false).
+ }
+ this.m = f;
+ return f;
+}
+
+var obj = {
+ set m(f) {
+ if (f()) // Call once to resolve x on the Call object,
+ // for shape consistency. Otherwise loop gets
+ // recorded twice.
+ loop(f, true);
+ }
+};
+
+loop(C.call(obj, false), false);
+C.call(obj, true);