3764898a23
The current version of CloneAndInlineBlock assumes that the inlined block is a direct predecessor of the currently reduced block. With recent Return reductions implemented in branch elimination that's no longer the case, as we're looking one edge past the current block. Bug: chromium:1399626 Change-Id: I2ce23672c0e33b2857a4663d8e7ad5ed1df3c20e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4097125 Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#84862}
20 lines
437 B
JavaScript
20 lines
437 B
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
proto = Object.getPrototypeOf(0);
|
|
|
|
function foo(v) {
|
|
properties = Object.getOwnPropertyNames(proto);
|
|
if (properties.includes("constructor") &&
|
|
v.constructor.hasOwnProperty()) {
|
|
}
|
|
}
|
|
|
|
function bar(n) {
|
|
if (n > 5000) return;
|
|
foo(0) ;
|
|
bar(n+1);
|
|
}
|
|
bar(1);
|