diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-1420536.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-1420536.js | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-1420536.js b/deps/v8/test/mjsunit/regress/regress-1420536.js new file mode 100644 index 0000000000..175becf2f1 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-1420536.js @@ -0,0 +1,34 @@ +// Copyright 2023 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f() { this.x = 1; } +for (var i = 0; i < 10; i++) new f(); + +function foo() { + var obj = new f(); + obj.y = -1073741825; + return obj; +} + +function bar(t) { + var arr = []; + for (var p in t){ + arr.push([ t[p]]); + } + return arr; +} + +function test() { + return bar(foo()); +} + +%PrepareFunctionForOptimization(f); +%PrepareFunctionForOptimization(foo); +%PrepareFunctionForOptimization(bar); +%PrepareFunctionForOptimization(test); +assertEquals([[1], [-1073741825]], test(foo, bar)); +%OptimizeFunctionOnNextCall(test); +assertEquals([[1], [-1073741825]], test(foo, bar)); |