v8/test/mjsunit/compiler/regress-crbug-1355824.js
Tobias Tebbi ac23cc0470 [compiler] JSCallReducer: check uses based on index
Bug: chromium:1355824
Change-Id: Ic0809f68259939086ad0e9a329b718eaf0e107aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3869266
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82922}
2022-09-02 07:05:06 +00:00

20 lines
547 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(...v) {
function bar() {
return arguments.length;
}
Array.prototype.splice.apply(v, v);
Array.prototype.splice.apply(v, v);
return bar(...v);
}
%PrepareFunctionForOptimization(foo);
assertEquals(3, foo(1, 2, 3, 4));
%OptimizeFunctionOnNextCall(foo);
assertEquals(3, foo(1, 2, 3, 4));
assertEquals(3, foo(1, 2, 3, 4));