The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/jit-test/tests/ion/bug-770309-mcall-bailout.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,68 @@
     1.4 +
     1.5 +// Test various code paths associated with fused getprop/poly inlining.
     1.6 +
     1.7 +function A(a) { this.a = a; }
     1.8 +A.prototype.foo = function (x) { return (x % 3) + this.a; };
     1.9 +
    1.10 +function B(b) { this.b = b; }
    1.11 +B.prototype.foo = function (x) { return (x % 3) + this.b + 1; };
    1.12 +
    1.13 +// c.foo() for some (c instanceof C) should always hit the fallback
    1.14 +// path of any fused poly inline cache created for it.
    1.15 +function C(c) { this.c = c; }
    1.16 +var GLOBX = {'x': function (x) {
    1.17 +    if (x > 29500)
    1.18 +        throw new Error("ERROR");
    1.19 +    return 2;
    1.20 +}};
    1.21 +function C_foo1(x) {
    1.22 +    return (x % 3) + this.c + GLOBX.x(x) + 1;
    1.23 +}
    1.24 +function C_foo2(x) {
    1.25 +    return (x % 3) + this.c + GLOBX.x(x) + 2;
    1.26 +}
    1.27 +C.prototype.foo = C_foo1;
    1.28 +
    1.29 +// Create an array of As, Bs, and Cs.
    1.30 +function makeArray(n) {
    1.31 +    var classes = [A, B, C];
    1.32 +    var arr = [];
    1.33 +    for (var i = 0; i < n; i++) {
    1.34 +        arr.push(new classes[i % 3](i % 3));
    1.35 +    }
    1.36 +    return arr;
    1.37 +}
    1.38 +
    1.39 +// Call foo on them, sum up results into first elem of resultArray
    1.40 +function runner(arr, resultArray, len) {
    1.41 +    for (var i = 0; i < len; i++) {
    1.42 +        // This changes the type of returned value from C.foo(), leading to
    1.43 +        // a bailout fater the call obj.foo() below.
    1.44 +        var obj = arr[i];
    1.45 +        resultArray[0] += obj.foo(i);
    1.46 +    }
    1.47 +}
    1.48 +
    1.49 +// Make an array of instance.
    1.50 +var resultArray = [0];
    1.51 +var arr = makeArray(30000);
    1.52 +
    1.53 +// Run runner for a bit with C.prototype.foo being C_foo1
    1.54 +runner(arr, resultArray, 100);
    1.55 +
    1.56 +// Run runner for a bit with C.prototype.foo being C_foo2
    1.57 +C.prototype.foo = C_foo2;
    1.58 +runner(arr, resultArray, 100);
    1.59 +
    1.60 +// Run runner for a bit longer to force GLOBX.x to raise
    1.61 +// an error inside a call to C.prototype.foo within runner.
    1.62 +var gotError = false;
    1.63 +try {
    1.64 +    runner(arr, resultArray, 30000);
    1.65 +} catch(err) {
    1.66 +    gotError = true;
    1.67 +}
    1.68 +
    1.69 +// Check results.
    1.70 +assertEq(gotError, true);
    1.71 +assertEq(resultArray[0], 108859);