summaryrefslogtreecommitdiffstats
path: root/js/src/tests/js1_8_1/regress/regress-452498-053.js
diff options
context:
space:
mode:
Diffstat (limited to 'js/src/tests/js1_8_1/regress/regress-452498-053.js')
-rw-r--r--js/src/tests/js1_8_1/regress/regress-452498-053.js80
1 files changed, 80 insertions, 0 deletions
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-053.js b/js/src/tests/js1_8_1/regress/regress-452498-053.js
new file mode 100644
index 000000000..9f70a0f74
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-053.js
@@ -0,0 +1,80 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+ enterFunc ('test');
+ printBugNumber(BUGNUMBER);
+ printStatus (summary);
+
+// ------- Comment #53 From Jason Orendorff
+
+// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
+// at ../jsobj.cpp:5559
+// On the last line of BindLet, we have
+// JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
+// but this uses reserved slots as though they were unlimited.
+// blockObj only has 2.
+ { let a=0, b=1, c=2; }
+
+// In RecycleTree at ../jsparse.cpp:315, we hit
+// MOZ_CRASH("RecycleUseDefKids");
+// pn->pn_type is TOK_UNARYOP
+// pn->pn_op is JSOP_XMLNAME
+// pn->pn_defn is 1
+// pn->pn_used is 1
+ try
+ {
+ true; 0;
+ }
+ catch(ex)
+ {
+ }
+// Calls LinkUseToDef with pn->pn_defn == 1.
+//
+// If you say "var x;" first, then run this case, it gets further,
+// crashing in NoteLValue like the first case in comment 52.
+//
+ try
+ {
+ for (var [x] in y) var x;
+ }
+ catch(ex)
+ {
+ }
+// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
+// Another case where some optimization is going on.
+ try
+ {
+ if (true && foo) ;
+ }
+ catch(ex)
+ {
+ }
+// Assertion failure: scope->object == ctor
+// in js_FastNewObject at ../jsbuiltins.cpp:237
+//
+// With the patch, we're new-ing a different function each time, and the
+// .prototype property is missing.
+//
+ for (var z = 0; z < 3; z++) { (new function(){}); }
+
+ reportCompare(expect, actual, summary);
+
+ exitFunc ('test');
+}