v8/test/mjsunit/compiler/regress-758983.js
Jaroslav Sevcik a529f128a3 [turbofan] Retype ConvertTaggedHoleToUndefined in representation selection.
Bug: chromium:758983
Change-Id: Iea65c6c6330b4eed0969eee1f8b261e1446771f5
Reviewed-on: https://chromium-review.googlesource.com/640382
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47669}
2017-08-29 08:56:07 +00:00

20 lines
391 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var holey = [ 2.2,,"x" ];
function f(b) {
holey[0] = 1.1;
var r = holey[0];
r = b ? r : 0;
return r < 0;
}
f(true);
f(true);
%OptimizeFunctionOnNextCall(f);
assertFalse(f(true));