v8/test/mjsunit/regress/regress-crbug-1020162.js

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --throws

((get = foo.get(...a, a), b) => 0)();
[parser] Force stable order for variables When parsing an arrowhead, it's possible for temporary variables to be created with a different index depending on whether the parsing is lazy or eager. This then results in bytecode mismatches as the index is used to determine which register to use. To make the ordering stable, this changes variable allocation in arrow functions to always allocate the non-temporaries first and then the temporaries. Bug: chromium:1020162 Change-Id: Ia47c4c2916d63f12d20d663e4e3842bfd68f6d8e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1977865 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#65657} 2020-01-09 09:33:44 +00:00			`// Copyright 2019 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`// Flags: --throws`

			`((get = foo.get(...a, a), b) => 0)();`