michael@0: /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
michael@0: /*
michael@0:  * Any copyright is dedicated to the Public Domain.
michael@0:  * http://creativecommons.org/licenses/publicdomain/
michael@0:  * Contributor: Jason Orendorff
michael@0:  */
michael@0: 
michael@0: //-----------------------------------------------------------------------------
michael@0: var BUGNUMBER = 452498;
michael@0: var summary = 'TM: upvar2 regression tests';
michael@0: var actual = '';
michael@0: var expect = '';
michael@0: 
michael@0: 
michael@0: //-----------------------------------------------------------------------------
michael@0: test();
michael@0: //-----------------------------------------------------------------------------
michael@0: 
michael@0: function test()
michael@0: {
michael@0:   enterFunc ('test');
michael@0:   printBugNumber(BUGNUMBER);
michael@0:   printStatus (summary);
michael@0: 
michael@0: // ------- Comment #53 From Jason Orendorff
michael@0: 
michael@0: // Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
michael@0: // at ../jsobj.cpp:5559
michael@0: // On the last line of BindLet, we have
michael@0: //    JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
michael@0: // but this uses reserved slots as though they were unlimited.
michael@0: // blockObj only has 2.
michael@0:   let (a=0, b=1, c=2) {}
michael@0: 
michael@0: // In RecycleTree at ../jsparse.cpp:315, we hit
michael@0: //     MOZ_ASSUME_UNREACHABLE("RecycleUseDefKids");
michael@0: // pn->pn_type is TOK_UNARYOP
michael@0: // pn->pn_op   is JSOP_XMLNAME
michael@0: // pn->pn_defn is 1
michael@0: // pn->pn_used is 1
michael@0:   try
michael@0:   {
michael@0:     true; 0;
michael@0:   }
michael@0:   catch(ex)
michael@0:   {
michael@0:   }
michael@0: // Calls LinkUseToDef with pn->pn_defn == 1.
michael@0: //
michael@0: // If you say "var x;" first, then run this case, it gets further,
michael@0: // crashing in NoteLValue like the first case in comment 52.
michael@0: //
michael@0:   try
michael@0:   {
michael@0:     for (var [x] = x in y) var x;
michael@0:   }
michael@0:   catch(ex)
michael@0:   {
michael@0:   }
michael@0: // Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
michael@0: // Another case where some optimization is going on.
michael@0:   try
michael@0:   {
michael@0:     if (true && foo) ;
michael@0:   }
michael@0:   catch(ex)
michael@0:   {
michael@0:   }
michael@0: // Assertion failure: scope->object == ctor
michael@0: // in js_FastNewObject at ../jsbuiltins.cpp:237
michael@0: //
michael@0: // With the patch, we're new-ing a different function each time, and the
michael@0: // .prototype property is missing.
michael@0: //
michael@0:   for (var z = 0; z < 3; z++) { (new function(){}); }
michael@0: 
michael@0:   reportCompare(expect, actual, summary);
michael@0: 
michael@0:   exitFunc ('test');
michael@0: }