The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/tests/js1_8_5/regress/regress-554955-4.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,36 @@
     1.4 +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
     1.5 +/*
     1.6 + * Any copyright is dedicated to the Public Domain.
     1.7 + * http://creativecommons.org/licenses/publicdomain/
     1.8 + */
     1.9 +
    1.10 +function f() {
    1.11 +    return function(a) {
    1.12 +        // This eval must take place before the block is cloned, when the
    1.13 +        // call object is still not marked as a delegate. The scope chain
    1.14 +        // purge for the JSOP_DEFVAR will not change the global's shape,
    1.15 +        // and the property cache entry will remain valid.
    1.16 +        eval(a);
    1.17 +        let (c = 3) {
    1.18 +            // This eval forces the block to be cloned, so its shape gets
    1.19 +            // used as the property cache key shape.
    1.20 +            eval('');
    1.21 +            return b;
    1.22 +        };
    1.23 +    };
    1.24 +}
    1.25 +
    1.26 +var b = 1;
    1.27 +var g1 = f();
    1.28 +var g2 = f();
    1.29 +
    1.30 +/* Call the lambda once, caching a reference to the global b. */
    1.31 +g1('');
    1.32 +
    1.33 +/*
    1.34 + * If this call sees the above cache entry, then it will erroneously use the
    1.35 + * global b.
    1.36 + */
    1.37 +assertEq(g2('var b=2'), 2);
    1.38 +
    1.39 +reportCompare(true, true);