src/third_party/mozjs-45/js/src/tests/js1_8_1/regress/regress-452498-053.js

/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
/*
 * Any copyright is dedicated to the Public Domain.
 * http://creativecommons.org/licenses/publicdomain/
 * Contributor: Jason Orendorff
 */

//-----------------------------------------------------------------------------
var BUGNUMBER = 452498;
var summary = 'TM: upvar2 regression tests';
var actual = '';
var expect = '';


//-----------------------------------------------------------------------------
test();
//-----------------------------------------------------------------------------

function test()
{
  enterFunc ('test');
  printBugNumber(BUGNUMBER);
  printStatus (summary);

// ------- Comment #53 From Jason Orendorff

// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
// at ../jsobj.cpp:5559
// On the last line of BindLet, we have
//    JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
// but this uses reserved slots as though they were unlimited.
// blockObj only has 2.
  { let a=0, b=1, c=2; }

// In RecycleTree at ../jsparse.cpp:315, we hit
//     MOZ_CRASH("RecycleUseDefKids");
// pn->pn_type is TOK_UNARYOP
// pn->pn_op   is JSOP_XMLNAME
// pn->pn_defn is 1
// pn->pn_used is 1
  try
  {
    true; 0;
  }
  catch(ex)
  {
  }
// Calls LinkUseToDef with pn->pn_defn == 1.
//
// If you say "var x;" first, then run this case, it gets further,
// crashing in NoteLValue like the first case in comment 52.
//
  try
  {
    for (var [x] in y) var x;
  }
  catch(ex)
  {
  }
// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
// Another case where some optimization is going on.
  try
  {
    if (true && foo) ;
  }
  catch(ex)
  {
  }
// Assertion failure: scope->object == ctor
// in js_FastNewObject at ../jsbuiltins.cpp:237
//
// With the patch, we're new-ing a different function each time, and the
// .prototype property is missing.
//
  for (var z = 0; z < 3; z++) { (new function(){}); }

  reportCompare(expect, actual, summary);

  exitFunc ('test');
}