v8/test/mjsunit/regress/regress-457935.js
jarin 3f3558f365 Convert to immutable heap number when materializing arguments object.
BUG=chromium:457935
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/935623002

Cr-Commit-Position: refs/heads/master@{#26704}
2015-02-17 18:08:59 +00:00

27 lines
442 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function dummy(x) { };
function g() {
return g.arguments;
}
function f(limit) {
var i = 0;
var o = {};
for (; i < limit; i++) {
o.y = +o.y;
g();
}
}
f(1);
f(1);
%OptimizeFunctionOnNextCall(f);
dummy(f(1));
dummy(f(2));