tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1851599.js (790B)


      1 // |jit-test| --fast-warmup; --no-threads
      2 
      3 function foo(phase, o1, o2) {
      4  switch (phase) {
      5    case 1:
      6      return o1.x;
      7    case 2:
      8      return o1.x + o2.x;
      9  }
     10 }
     11 
     12 // Set `foo` as last child and `bar` as last parent.
     13 function phase1() {
     14  eval(`
     15  function bar(o) {
     16    foo(1, o);
     17  }
     18  with ({}) {}
     19  for (var j = 0; j < 100; j++) {
     20    var obj = {x: 1};
     21    obj["y" + (j % 10)] = 2;
     22    bar(obj);
     23  }
     24  bar({y: 1, x: 2});
     25  `);
     26 }
     27 phase1();
     28 
     29 // Collect `bar`.
     30 gc();
     31 
     32 // Recompile `foo` monomorphically.
     33 with ({}) {}
     34 for (var i = 0; i < 100; i++) {
     35  foo(2, {x: 1}, {x: 1});
     36 }
     37 
     38 // Bail out and create a folded stub in `foo`.
     39 // The child matches, so we use `bar` as the owning script.
     40 for (var i = 0; i < 6; i++) {
     41  var obj = {x: 1};
     42  obj["y" + i] = 2;
     43  foo(2, {y: 1, x: 2}, obj);
     44 }