summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/TypedObject/bug950458.js
blob: 7c90c7bccd4f43348da2726e489ff5096007fa8e (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
if (!this.hasOwnProperty("TypedObject"))
  quit();

// Test for fuzz condition failure. Cause of the failure
// was that we were not adding a type barrier after the
// creation of derived typed objects. When run in --ion-eager
// mode, arr[i] (below) would yield a derived typed object
// with an empty type set, which would then fail sanity
// checking assertions.
//
// Public domain.

var N = 100;
var T = TypedObject;
var Point = new T.StructType({x: T.uint32, y: T.uint32, z: T.uint32});
var PointArray = Point.array(N);
function foo(arr) {
  var sum = 0;
  for (var i = 0; i < N; i++) {
    sum += arr[i].x + arr[i].y + arr[i].z;
  }
}
foo(new PointArray());