tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

recover-osr-arguments-oob.js (650B)

      1 setJitCompilerOption("baseline.warmup.trigger", 0);
      2 setJitCompilerOption("ion.warmup.trigger", 120);
      3 gczeal(0);
      4 with ({}) {}
      5 
      6 function bar(i) {
      7    // |arguments| can be recovered, even if this is inlined into an OSR script.
      8    assertRecoveredOnBailout(arguments, true);
      9    return arguments[i & 1]|0;
     10 }
     11 
     12 function foo(n) {
     13    // |arguments| for an OSR script can't be recovered.
     14    assertRecoveredOnBailout(arguments, false);
     15    var sum = 0;
     16    for (var i = 0; i < n; i++) {
     17        sum += bar(i);
     18    }
     19    trialInline();
     20    return sum;
     21 }
     22 
     23 // Trigger trial-inlining of bar into foo.
     24 foo(110);
     25 
     26 // OSR-compile foo.
     27 assertEq(foo(1000), 249500);