v8/test/mjsunit/regress/regress-bind-deoptimize.js
Maya Lekova d978b5c00c [turbofan] Fix wrong serialization for Function.bind
Bug: v8:7790
Change-Id: I31502a8023564e88e0a28a421e3c7fb3404847dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722566
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62973}
2019-07-30 07:55:12 +00:00

25 lines
613 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt --no-always-opt
(function() {
function bla(x) {
return this[x];
}
function foo(f) {
return bla.bind(f())(0);
};
%PrepareFunctionForOptimization(foo);
foo(() => { return [true]; });
foo(() => { return [true]; });
%OptimizeFunctionOnNextCall(foo);
foo(() => { return [true]; });
assertOptimized(foo);
foo(() => { bla.a = 1; return [true]; });
assertUnoptimized(foo);
})();