JavaScriptCore-7601.1.46.3.tar.gz

[apple/javascriptcore.git] / tests / stress / for-in-proxy-target-changed-structure.js

diff --git a/tests/stress/for-in-proxy-target-changed-structure.js b/tests/stress/for-in-proxy-target-changed-structure.js
new file mode 100644 (file)
index 0000000..5c9d76f
--- /dev/null
+++ b/tests/stress/for-in-proxy-target-changed-structure.js
@@ -0,0 +1,32 @@
+var theO;
+
+function deleteAll() {
+    delete theO.a;
+    delete theO.b;
+    delete theO.c;
+    delete theO.d;
+    for (var i = 0; i < 10; ++i)
+        theO["i" + i] = 42;
+    theO.a = 11;
+    theO.b = 12;
+    theO.c = 13;
+    theO.d = 14;
+}
+
+function foo(o_) {
+    var o = o_;
+    var result = 0;
+    for (var s in o) {
+        result += o[s];
+        deleteAll();
+    }
+    return result;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 10000; ++i) {
+    var result = foo(createProxy(theO = {a:1, b:2, c:3, d:4}));
+    if (result != 1 + 12 + 13 + 14)
+        throw "Error: bad result: " + result;
+}