tor-browser

commit cdd430731164e677d4d9c58dcd9e81e51982982e
parent 8b3cbfa58a8dd73ee2ebb7c0bbc4dd04d7271714
Author: Iain Ireland <iireland@mozilla.com>
Date:   Tue, 25 Nov 2025 22:35:25 +0000

Bug 1989978: Add tests r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D266024

Diffstat:
A
js/src/jit-test/tests/ion/bug1989978-1.js
 | 
13
+++++++++++++
A
js/src/jit-test/tests/ion/bug1989978-2.js
 | 
12
++++++++++++
A
js/src/jit-test/tests/ion/bug1989978-3.js
 | 
26
++++++++++++++++++++++++++

3 files changed, 51 insertions(+), 0 deletions(-)
diff --git a/js/src/jit-test/tests/ion/bug1989978-1.js b/js/src/jit-test/tests/ion/bug1989978-1.js
@@ -0,0 +1,13 @@
+// |jit-test| --no-threads
+
+function opt(a) {
+  for (const it in a) {
+    a[it] = 5;
+  }
+}
+const obj = {};
+Object.defineProperty(obj, "x", {value: 1, enumerable: true, writable: false});
+for (let i = 0; i < 2000; i++) {
+  opt(obj);
+}
+assertEq(obj.x, 1);
diff --git a/js/src/jit-test/tests/ion/bug1989978-2.js b/js/src/jit-test/tests/ion/bug1989978-2.js
@@ -0,0 +1,12 @@
+// |jit-test| --no-threads
+
+function opt(a) {
+    for (const it in a) {
+        a[it] = 5;
+    }
+}
+const obj = JSON.rawJSON(256n, 256n, opt);
+for (let i = 0; i < 100; i++) {
+    opt(obj);
+}
+JSON.stringify(obj);
diff --git a/js/src/jit-test/tests/ion/bug1989978-3.js b/js/src/jit-test/tests/ion/bug1989978-3.js
@@ -0,0 +1,26 @@
+// |jit-test| --no-threads; --fast-warmup
+
+let o = { x: 1 };
+addObjectFuse(o);
+
+function foo() {
+  return o.x;
+}
+
+function replace(obj, val) {
+    for (var key in obj) {
+        obj[key] = val;
+    }
+}
+
+with ({}) {}
+for (var i = 0; i < 100; i++) {
+  foo(10);
+}
+for (var i = 0; i < 100; i++) {
+  replace({a: 0}, 1);
+  replace({a: 0, b: 0}, 1);
+}
+
+replace(o, 2);
+assertEq(foo(), 2);