The Tor Browser / file comparison
comparison: js/src/tests/js1_8_5/regress/regress-554955-4.js
js/src/tests/js1_8_5/regress/regress-554955-4.js
- branch
- TOR_BUG_3246
- changeset 7
- 129ffea94266
equal
deleted
inserted
replaced
| -1:000000000000 | 0:2f2891ecd552 |
|---|---|
| 1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ | |
| 2 /* | |
| 3 * Any copyright is dedicated to the Public Domain. | |
| 4 * http://creativecommons.org/licenses/publicdomain/ | |
| 5 */ | |
| 6 | |
| 7 function f() { | |
| 8 return function(a) { | |
| 9 // This eval must take place before the block is cloned, when the | |
| 10 // call object is still not marked as a delegate. The scope chain | |
| 11 // purge for the JSOP_DEFVAR will not change the global's shape, | |
| 12 // and the property cache entry will remain valid. | |
| 13 eval(a); | |
| 14 let (c = 3) { | |
| 15 // This eval forces the block to be cloned, so its shape gets | |
| 16 // used as the property cache key shape. | |
| 17 eval(''); | |
| 18 return b; | |
| 19 }; | |
| 20 }; | |
| 21 } | |
| 22 | |
| 23 var b = 1; | |
| 24 var g1 = f(); | |
| 25 var g2 = f(); | |
| 26 | |
| 27 /* Call the lambda once, caching a reference to the global b. */ | |
| 28 g1(''); | |
| 29 | |
| 30 /* | |
| 31 * If this call sees the above cache entry, then it will erroneously use the | |
| 32 * global b. | |
| 33 */ | |
| 34 assertEq(g2('var b=2'), 2); | |
| 35 | |
| 36 reportCompare(true, true); |
