summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/ion/lexical-check-6.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/jit-test/tests/ion/lexical-check-6.js')
-rw-r--r--js/src/jit-test/tests/ion/lexical-check-6.js39
1 files changed, 39 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/ion/lexical-check-6.js b/js/src/jit-test/tests/ion/lexical-check-6.js
new file mode 100644
index 000000000..5af7686ae
--- /dev/null
+++ b/js/src/jit-test/tests/ion/lexical-check-6.js
@@ -0,0 +1,39 @@
+// This function uses UCE to test when the if branch is removed by
+// IonMonkey. Some optimization such as Scalar Replacement are able to remove
+// the scope chain, which can cause issues when the scope chain properties are
+// not initialized properly.
+var uceFault = function (i) {
+ if (i % 1500 == 0) {
+ uceFault = function (i) { return i % 1500 == 0; };
+ }
+ return false;
+};
+
+function f(i) {
+ if (uceFault(i) || uceFault(i))
+ g();
+ const x = 42;
+ function g() {
+ return x;
+ }
+ return g;
+}
+
+function loop() {
+ for (; i < 4000; i++)
+ assertEq(f(i)(), 42);
+}
+
+var caught = 0;
+var i = 1;
+while (i < 4000) {
+ try {
+ loop();
+ } catch(e) {
+ assertEq(e instanceof ReferenceError, true);
+ assertEq(i == 1500 || i == 3000, true);
+ caught += 1;
+ i++;
+ }
+}
+assertEq(caught, 2);