summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js')
-rw-r--r--js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js32
1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js
new file mode 100644
index 000000000..9bf3c0c38
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testGuardCalleeSneakAttack2.js
@@ -0,0 +1,32 @@
+function loop(f, expected) {
+ // This is the loop that breaks us.
+ // At record time, f's parent is a Call object with no fp.
+ // At second execute time, it is a Call object with fp,
+ // and all the Call object's dslots are still JSVAL_VOID.
+ for (var i = 0; i < 9; i++)
+ assertEq(f(), expected);
+}
+
+function C(bad) {
+ var x = bad;
+ function f() {
+ return x; // We trick TR::callProp() into emitting code that gets
+ // JSVAL_VOID (from the Call object's dslots)
+ // rather than the actual value (true or false).
+ }
+ if (bad)
+ void (f + "a!");
+ return f;
+}
+
+var obj = {
+};
+
+// Warm up and trace with C's Call object entrained but its stack frame gone.
+loop(C.call(obj, false), false);
+
+// Sneaky access to f via a prototype method called implicitly by operator +.
+Function.prototype.toString = function () { loop(this, true); return "hah"; };
+
+// Fail hard if we don't handle the implicit call out of C to F.p.toString.
+C.call(obj, true);