df490c3484
The module size is encoded as a HeapNumber, and needs to be explicitly cloned. BUG=chromium:647649 Review-Url: https://codereview.chromium.org/2347333002 Cr-Commit-Position: refs/heads/master@{#39845}
44 lines
1.2 KiB
JavaScript
44 lines
1.2 KiB
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --nostress-opt --expose-gc --invoke-weak-callbacks --validate-asm
|
|
// Flags: --noalways-opt --invoke-weak-callbacks
|
|
|
|
// This test was generated by the fuzzer.
|
|
|
|
function getRandomProperty(v, rand) {
|
|
var properties = Object.getOwnPropertyNames(v);
|
|
var proto = Object.getPrototypeOf(v);
|
|
if (proto) {; }
|
|
if ("constructor" && v.constructor.hasOwnProperty()) {; }
|
|
if (properties.length == 0) { return "0"; }
|
|
return properties[rand % properties.length];
|
|
}
|
|
|
|
var __v_11 = {};
|
|
|
|
function __f_1(stdlib, foreign, buffer) {
|
|
"use asm";
|
|
var __v_3 = new stdlib.Float64Array(buffer);
|
|
function __f_0() {
|
|
var __v_1 = 6.0;
|
|
__v_3[2] = __v_1 + 1.0;
|
|
}
|
|
return {__f_0: __f_0};
|
|
}
|
|
try {
|
|
var __v_0 = new ArrayBuffer(207222809);
|
|
var module = __f_1(this, null, __v_0);
|
|
( {
|
|
})();
|
|
} catch(e) {; }
|
|
__v_13 = '@3'
|
|
Array.prototype.__proto__ = {3: __v_13};
|
|
Array.prototype.__proto__.__proto__ = {7: __v_11};
|
|
__v_9 = [0, 1, , , 4, 5, , , , 9]
|
|
__v_12 = __v_9.splice(4, 1)
|
|
__v_9.__defineGetter__(getRandomProperty(__v_9, 1689439720), function() {; return __f_1(); });
|
|
__v_9[8]
|
|
gc();
|