tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

inline-arguments-oob-negative-index-2.js (525B)

      1 // |jit-test| --fast-warmup
      2 
      3 function inner(i) {
      4  // Can't be eliminated because negative indices cause a bailout.
      5  arguments[i];
      6  arguments[i];
      7  arguments[i];
      8 }
      9 
     10 function outer(i) {
     11  trialInline();
     12 
     13  // Loop header to trigger OSR.
     14  for (let j = 0; j < 1; ++j) {
     15    inner(i);
     16  }
     17 }
     18 
     19 let count = 0;
     20 
     21 for (let i = 0; i <= 100; ++i) {
     22    if (i === 50) {
     23      Object.defineProperty(Object.prototype, -1, {
     24        get() {
     25          count++;
     26        }
     27      });
     28    }
     29    outer(i < 100 ? i : -1);
     30 }
     31 
     32 assertEq(count, 3);