v8/test/mjsunit/regress/regress-crbug-967434.js

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function f1(h_also_eval) {
  this.x = h_also_eval;
}

function f2(h, h_eval) {
  var o = new f1(h());
  // During the last call to f3 with g2 as an argument, this store is
  // bi-morphic, including a version that refers to the old map (before
  // the replacement of f1's prototype). As a result, during load elimination
  // we see two stores with incompatible representations: One in the
  // constructor, and one in the impossible branch of the bi-morphic store
  // site.
  o.x = h_eval;
};
%PrepareFunctionForOptimization(f2);
function f3(h) {
  f2(h, h());
  %OptimizeFunctionOnNextCall(f2);
  f2(h, h());
}

function g1() {
  return {};
};
function g2() {
  return 4.2;
};

f3(g1);
f3(g2);

f3(g1);
f1.prototype = {};
f3(g2);