bug1568397.js (1208B)
1 // |jit-test| --setpref=property_error_message_fix=true; error:TypeError: can't access property "x" 2 let obj = {x: 1}; 3 obj.x = 1.1; 4 5 function Foo(val, phase){ 6 if (phase == 3) { 7 // Phase 3: Modify the prototype of this constructor. 8 Foo.prototype.__proto__ = proto; 9 } 10 11 // Phase 4: Trigger the getter on the new proto. 12 this.d; 13 14 this.c = val; 15 16 if (phase == 2) { 17 // Phase 2: Stash |this| in a global variable. 18 g_partial = this; 19 20 // Trigger Phase 3. 21 new Foo(1.1, 3); 22 } 23 this.b = 2.2; 24 } 25 26 let proto = {get d() { 27 function accessC(arg){ 28 var tmp = arg.c; 29 return tmp.x; 30 } 31 32 // Phase 5: Ion-compile |accessC|, using the stashed |this| from phase 2. 33 // This is a partially initialized object with a C property but not a B 34 // property. 35 for (var i = 0; i < 100000; i++) { 36 accessC(g_partial); 37 } 38 39 // Phase 6: call |accessC| with |this|, which is a partially initialized 40 // object *without* a C (and B) property. 41 x = accessC(this); 42 }}; 43 44 // Phase 1: Warm up the |Foo| constructor with normal data. 45 for(let i = 0;i < 100;i++){ 46 new Foo(obj, 1); 47 } 48 49 // Trigger Phase 2. 50 new Foo(obj, 2);