v8/test/mjsunit/regress/regress-crbug-614644.js
bmeurer 173313e297 [crankshaft] Guard against side effects in Array.prototype.shift lowering.
We need to pay attention to potential side effects from parameter
evaluation when inlining the fast case Array.prototype.shift.

R=yangguo@chromium.org
BUG=chromium:614644

Review-Url: https://codereview.chromium.org/2161943002
Cr-Commit-Position: refs/heads/master@{#37850}
2016-07-19 06:43:04 +00:00

16 lines
335 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(a, x) {
a.shift(2, a.length = 2);
a[0] = x;
}
f([ ], 1.1);
f([1], 1.1);
%OptimizeFunctionOnNextCall(f);
f([1], 1.1);