v8/test/mjsunit/regress/regress-crbug-768367.js
Benedikt Meurer adfaf74d33 [turbofan] Fix off-by-one in constant-folding of frozen elements.
Bug: chromium:768367, v8:6819, v8:6820, v8:6831
Change-Id: I90538217f794c91a83ae5cfb12e0d0347d5f8574
Reviewed-on: https://chromium-review.googlesource.com/685240
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48175}
2017-09-27 05:43:25 +00:00

15 lines
389 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
const o = {};
function foo() { return o[4294967295]; }
assertEquals(undefined, foo());
assertEquals(undefined, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(undefined, foo());