1 files changed, 80 insertions, 0 deletions
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-053.js b/js/src/tests/js1_8_1/regress/regress-452498-053.js
new file mode 100644
index 000000000..9f70a0f74
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-053.js
@@ -0,0 +1,80 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #53 From Jason Orendorff
+
+// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
+// at ../jsobj.cpp:5559
+// On the last line of BindLet, we have
+//    JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
+// but this uses reserved slots as though they were unlimited.
+// blockObj only has 2.
+  { let a=0, b=1, c=2; }
+
+// In RecycleTree at ../jsparse.cpp:315, we hit
+//     MOZ_CRASH("RecycleUseDefKids");
+// pn->pn_type is TOK_UNARYOP
+// pn->pn_op   is JSOP_XMLNAME
+// pn->pn_defn is 1
+// pn->pn_used is 1
+  try
+  {
+    true; 0;
+  }
+  catch(ex)
+  {
+  }
+// Calls LinkUseToDef with pn->pn_defn == 1.
+//
+// If you say "var x;" first, then run this case, it gets further,
+// crashing in NoteLValue like the first case in comment 52.
+//
+  try
+  {
+    for (var [x] in y) var x;
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
+// Another case where some optimization is going on.
+  try
+  {
+    if (true && foo) ;
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: scope->object == ctor
+// in js_FastNewObject at ../jsbuiltins.cpp:237
+//
+// With the patch, we're new-ing a different function each time, and the
+// .prototype property is missing.
+//
+  for (var z = 0; z < 3; z++) { (new function(){}); }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}