v8/test/mjsunit/regress/regress-1028191.js
Nico Hartmann 3ce6be0275 [turbofan] Fixes crash caused by truncated bigint
Bug: chromium:1028191
Change-Id: Idfcd678b3826fb6238d10f1e4195b02be35c3010
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1936468
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65173}
2019-11-26 13:06:01 +00:00

24 lines
498 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
"use strict";
function f(a, b, c) {
let x = BigInt.asUintN(64, a + b);
try {
x + c;
} catch(_) {
eval();
}
return x;
}
%PrepareFunctionForOptimization(f);
assertEquals(f(3n, 5n), 8n);
assertEquals(f(8n, 12n), 20n);
%OptimizeFunctionOnNextCall(f);
assertEquals(f(2n, 3n), 5n);