diff options
author | Ben Noordhuis <info@bnoordhuis.nl> | 2016-04-06 12:07:45 +0200 |
---|---|---|
committer | Ben Noordhuis <info@bnoordhuis.nl> | 2016-04-07 13:14:25 +0200 |
commit | 3a8e8230eeeb1340ba4b8b99c7a58127f594f3fd (patch) | |
tree | 0a9188d937e90a1f1bd225d44462e18304061003 /deps/v8/test/mjsunit/regress/regress-crbug-589792.js | |
parent | d4eafd0c114b6765983c5524759656f335675835 (diff) | |
download | node-new-3a8e8230eeeb1340ba4b8b99c7a58127f594f3fd.tar.gz |
deps: upgrade to V8 4.9.385.35
PR-URL: https://github.com/nodejs/node/pull/6077
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-589792.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-589792.js | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-589792.js b/deps/v8/test/mjsunit/regress/regress-crbug-589792.js new file mode 100644 index 0000000000..f735afceae --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-589792.js @@ -0,0 +1,20 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +var boom = (function(stdlib, foreign, heap) { + "use asm"; + var MEM8 = new stdlib.Uint8Array(heap); + var MEM32 = new stdlib.Int32Array(heap); + function foo(i, j) { + j = MEM8[256]; + // This following value '10' determines the value of 'rax' + MEM32[j >> 10] = 0xabcdefaa; + return MEM32[j >> 2] + j + } + return foo +})(this, 0, new ArrayBuffer(256)); +%OptimizeFunctionOnNextCall(boom); +boom(0, 0x1000); |