3d58b82add
The bug was an error when copying arrays in crankshaft. If it's a holey smi array, the copy must be done as FAST_HOLEY_ELEMENTS to prevent representation changes from being inserted that deopt on encountering the hole. Also, prevent inlining array pop() and shift() if the length is read-only. BUG=435073 LOG=N R=verwaest@chromium.org Review URL: https://codereview.chromium.org/737383002 Cr-Commit-Position: refs/heads/master@{#25455}
13 lines
307 B
JavaScript
13 lines
307 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --verify-heap
|
|
|
|
function test(x) { [x,,]; }
|
|
|
|
test(0);
|
|
test(0);
|
|
%OptimizeFunctionOnNextCall(test);
|
|
test(0);
|