From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 js/src/jit-test/tests/TypedObject/bug950458.js | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 js/src/jit-test/tests/TypedObject/bug950458.js

(limited to 'js/src/jit-test/tests/TypedObject/bug950458.js')

diff --git a/js/src/jit-test/tests/TypedObject/bug950458.js b/js/src/jit-test/tests/TypedObject/bug950458.js
new file mode 100644
index 000000000..7c90c7bcc
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug950458.js
@@ -0,0 +1,23 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+// Test for fuzz condition failure. Cause of the failure
+// was that we were not adding a type barrier after the
+// creation of derived typed objects. When run in --ion-eager
+// mode, arr[i] (below) would yield a derived typed object
+// with an empty type set, which would then fail sanity
+// checking assertions.
+//
+// Public domain.
+
+var N = 100;
+var T = TypedObject;
+var Point = new T.StructType({x: T.uint32, y: T.uint32, z: T.uint32});
+var PointArray = Point.array(N);
+function foo(arr) {
+  var sum = 0;
+  for (var i = 0; i < N; i++) {
+    sum += arr[i].x + arr[i].y + arr[i].z;
+  }
+}
+foo(new PointArray());
-- 
cgit v1.2.3