diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-1408606.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-1408606.js | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-1408606.js b/deps/v8/test/mjsunit/regress/regress-1408606.js new file mode 100644 index 0000000000..01e3de1db1 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1408606.js @@ -0,0 +1,18 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +var v0 = new Uint8ClampedArray(); +function f0(cnt) { + Object.defineProperty(v0, cnt == 0 ? "subarray" : "property", { + }) + v0[-7] = -1.5; + v0[-7]; +} +%PrepareFunctionForOptimization(f0); +f0(0); +f0(); +%OptimizeFunctionOnNextCall(f0); +f0(); |