v8/test/mjsunit/regress/regress-358088.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

19 lines
449 B
JavaScript
Raw Normal View History

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function f(a) {
a[a.length] = 1;
}
function g(a, i, v) {
a[i] = v;
}
f([]); // f KeyedStoreIC goes to 1.GROW
o = {};
g(o); // We've added property "undefined" to o
o = {}; // A transition on property "undefined" exists from {}
f(o); // Store should go generic.