ArrayElementMissingValueSetToZero.js 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142
  1. //-------------------------------------------------------------------------------------------------------
  2. // Copyright (C) Microsoft. All rights reserved.
  3. // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
  4. //-------------------------------------------------------------------------------------------------------
  5. //flags: -maxinterpretcount:1 -maxsimplejitruncount:2 -force:rejit -ForceArrayBTree
  6. //Bug number: 109395
  7. var shouldBailout = false;
  8. function test0(){
  9. function makeArrayLength(x) { if(x < 1 || x > 4294967295 || x != x || isNaN(x) || !isFinite(x)) return 100; else return Math.floor(x) & 0xffff; };;
  10. var obj0 = {};
  11. var obj1 = {};
  12. var IntArr0 = new Array();
  13. var FloatArr0 = [1079966239,-2,-97174468.9,4.71984429732334E+18,373475323,516830569.1];
  14. obj1.prop2 = 1434939730.1;
  15. Object.prototype.prop1 = 1;
  16. Object.prototype.prop2 = 1;
  17. Object.prototype.length = makeArrayLength(1);
  18. for(var _strvar20 in Object.prototype )
  19. {
  20. (FloatArr0[(((((shouldBailout ? (FloatArr0[((((obj1.prop2-- )) >= 0 ? ( (obj1.prop2-- )) : 0) & 0xF)] = 'x') : undefined ), (obj1.prop2-- )) >= 0 ? (obj1.prop2-- ) : 0)) & 0XF)]);
  21. obj0.prop1 = IntArr0[((shouldBailout ? (IntArr0[1] = 'x') : undefined ), 1)];
  22. }
  23. };
  24. // generate profile
  25. test0();
  26. // Run Simple JIT
  27. test0();
  28. test0();
  29. // run JITted code
  30. runningJITtedCode = true;
  31. test0();
  32. // run code with bailouts enabled
  33. shouldBailout = true;
  34. test0();
  35. WScript.Echo("PASS");