9576d08c92
TailCallRuntime currently does not seem to handle adaptor frames correctly. BUG=chromium:688690 Review-Url: https://codereview.chromium.org/2675133003 Cr-Commit-Position: refs/heads/master@{#42950}
17 lines
488 B
JavaScript
17 lines
488 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var foo = "01234567";
|
|
|
|
foo += foo;
|
|
foo += foo;
|
|
foo += foo;
|
|
foo += foo;
|
|
foo += foo; // foo.length = 256;
|
|
|
|
// Create an adaptor frame, and take the StringReplaceOneCharWithString runtime
|
|
// fast path. This crashed originally since TailCallRuntime could not handle
|
|
// adaptor frames.
|
|
var bar = foo.replace('x', 'y', 'z');
|