JavaScriptCore-7601.1.46.3.tar.gz

[apple/javascriptcore.git] / tests / stress / branch-may-exit-due-to-object-or-other-use-kind.js

diff --git a/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js b/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js
new file mode 100644 (file)
index 0000000..aee19ed
--- /dev/null
+++ b/tests/stress/branch-may-exit-due-to-object-or-other-use-kind.js
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2015 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// Regression test for https://bugs.webkit.org/show_bug.cgi?id=144152
+
+// The bug in 144152 needs 3 conditions to manifest:
+// 1. The branch test value in the inlined function is of useKind ObjectOrOtherUse.
+// 2. The branch test value is proven to be a known useKind.
+// 3. The masqueradesAsUndefined watchpoint is no longer valid.
+// With the bug fixed, this test should not crash on debug builds.
+
+function inlinedFunction(x) {
+    if (x) // Conditional branch that will assert on a debug build if the bug is present.
+        new Object;
+}
+
+function foo(x) {
+    if (x) // Testing x before calling the inlined function sets up condition 2.
+        inlinedFunction(x);
+}
+
+makeMasquerader(); // Invalidates the masqueradesAsUndefined watchpoint for condition 3.
+for (var i = 0; i < 10000; i++)
+    foo({}); // Pass an object argument to set up condition 1.