Source code
Revision control
Copy as Markdown
Other Tools
/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
/*
* Any copyright is dedicated to the Public Domain.
* Contributor: Jason Orendorff
*/
//-----------------------------------------------------------------------------
var BUGNUMBER = 452498;
var summary = 'TM: upvar2 regression tests';
var actual = '';
var expect = '';
//-----------------------------------------------------------------------------
test();
//-----------------------------------------------------------------------------
function test()
{
printBugNumber(BUGNUMBER);
printStatus (summary);
// ------- Comment #53 From Jason Orendorff
// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
// at ../jsobj.cpp:5559
// On the last line of BindLet, we have
// JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
// but this uses reserved slots as though they were unlimited.
// blockObj only has 2.
{ let a=0, b=1, c=2; }
// In RecycleTree at ../jsparse.cpp:315, we hit
// MOZ_CRASH("RecycleUseDefKids");
// pn->pn_type is TOK_UNARYOP
// pn->pn_op is JSOP_XMLNAME
// pn->pn_defn is 1
// pn->pn_used is 1
try
{
true; 0;
}
catch(ex)
{
}
// Calls LinkUseToDef with pn->pn_defn == 1.
//
// If you say "var x;" first, then run this case, it gets further,
// crashing in NoteLValue like the first case in comment 52.
//
try
{
for (var [x] in y) var x;
}
catch(ex)
{
}
// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
// Another case where some optimization is going on.
try
{
if (true && foo) ;
}
catch(ex)
{
}
// Assertion failure: scope->object == ctor
// in js_FastNewObject at ../jsbuiltins.cpp:237
//
// With the patch, we're new-ing a different function each time, and the
// .prototype property is missing.
//
for (var z = 0; z < 3; z++) { (new function(){}); }
reportCompare(expect, actual, summary);
}