//------------------------------------------------------------------------------------------------------- | |
// Copyright (C) Microsoft. All rights reserved. | |
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information. | |
//------------------------------------------------------------------------------------------------------- | |
// Windows Blue Bug 146740 | |
// Run with -maxInterpretCount:1 | |
// When hoisting a field load or store would hoist the associated type check as well. However, this type check may | |
// be protecting other fields operations that are not hoistable, and would then be executed without the required type | |
// check. Here the field load of exhxkm (for ++exhxkm) ostensibly checked the type of the global object and produced | |
// a type value, which was then consumed by uiktzz++, but when copy prop replaced the load of exhxkm, the type check | |
// got removed as well. | |
x = this; | |
Object.prototype["uiktzz"] = function uiktzz() {} | |
function test() { | |
for (exhxkm = 0; exhxkm < 3; ++exhxkm) { | |
if (exhxkm == 1) { | |
(delete x.uiktzz); | |
} else { | |
uiktzz++; | |
} | |
}; | |
return x; | |
}; | |
// Interpreter call | |
test(); | |
// JIT call | |
test(); | |
test(); | |
test(); | |
WScript.Echo(uiktzz); | |
WScript.Echo(this.x.uiktzz); |