JSTests/ChakraCore/test/fieldopts/objtypespec-fieldhoist.2.js

//-------------------------------------------------------------------------------------------------------
// Copyright (C) Microsoft. All rights reserved.
// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
//-------------------------------------------------------------------------------------------------------

// Windows Blue Bug 146740
// Run with -maxInterpretCount:1
// When hoisting a field load or store would hoist the associated type check as well.  However, this type check may
// be protecting other fields operations that are not hoistable, and would then be executed without the required type
// check.  Here the field load of exhxkm (for ++exhxkm) ostensibly checked the type of the global object and produced
// a type value, which was then consumed by uiktzz++, but when copy prop replaced the load of exhxkm, the type check
// got removed as well.
x = this;
Object.prototype["uiktzz"] = function uiktzz() {}

function test() {
    for (exhxkm = 0; exhxkm < 3; ++exhxkm) {
        if (exhxkm == 1) {
            (delete x.uiktzz);
        } else {
            uiktzz++;
        }
    };
    return x;
};

// Interpreter call
test();

// JIT call
test();
test();
test();
WScript.Echo(uiktzz);
WScript.Echo(this.x.uiktzz);