6196dd051f
The optimized code for %ArrayIteratorPrototype%.next for holey arrays was wrong, since it would first store the [[NextIndex]] and then check whether it hit a hole. However in that case TurboFan doesn't have any point to deoptimize to, so we need to perform the side-effecting stores only after all checks are done. Bug: v8:7510, v8:7514, chromium:819086 Change-Id: I0214c7124833286113e4dc7403ddc20a82fa8da3 Reviewed-on: https://chromium-review.googlesource.com/950723 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#51753}
15 lines
315 B
JavaScript
15 lines
315 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo() {
|
|
return [...[, -Infinity]];
|
|
}
|
|
|
|
foo()[0];
|
|
foo()[0];
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo()[0];
|