v8/test/mjsunit/regress/regress-crbug-629823.js
bmeurer f793cb1fc3 [runtime] %TransitionElementsKind works for any kind of JSObject.
The optimizing compilers actually invoke %TransitionElementsKind for
any kind of JSObject, the only relevant thing is the elements kind.
The runtime function was however checking for JSArray unnecessarily.
This only worked by coincindence in Crankshaft because the stub would
normally not call into the runtime fallback.

R=jarin@chromium.org
BUG=chromium:629823

Review-Url: https://codereview.chromium.org/2166963004
Cr-Commit-Position: refs/heads/master@{#37919}
2016-07-21 07:23:58 +00:00

18 lines
358 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var o = {}
function bar() {
o[0] = +o[0];
o = /\u23a1|__v_4/;
}
bar();
bar();
bar();
function foo() { bar(); }
%OptimizeFunctionOnNextCall(foo);
foo();