bug1476417.js (738B)
1 function f(x) { 2 var y, z; 3 4 arguments; // Force creation of mapped arguments, so modifying |x| writes to the arguments object. 5 Math; // Access a global variable to create a resume point. 6 z = x + 1; // Was executed twice because only the resume point for 'Math' was present before the fix. 7 x = z; // Modifying |x| writes into the arguments object. We missed to create a resume point here. 8 y = 2 * x; // Triggers a bailout when overflowing int32 boundaries. 9 10 return [x, y]; 11 } 12 13 var x = [0, 0, 0x3FFFFFFF]; 14 15 for (var j = 0; j < 3; ++j) { 16 var value = x[j]; 17 var expected = [value + 1, (value + 1) * 2]; 18 var actual = f(value); 19 20 assertEq(actual[0], expected[0]); 21 assertEq(actual[1], expected[1]); 22 }