v8/test/mjsunit/regress/regress-v8-11851.js
Fanchen Kong dd740bc2cb Fix CSA_ASSERT failure in CollectCallFeedback
This failure comes as the feedback is cleared but the CallFeedbackContent field remain unchanged.

Bug: v8:11851
Change-Id: I75a0acad74dcaab1feafe97779e03caa8b7833de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2948426
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75090}
2021-06-11 02:14:42 +00:00

23 lines
463 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc
function v0(v1) {
v1.apply();
}
function v2() {
function v3() {
}
%PrepareFunctionForOptimization(v0);
v0(v3);
%OptimizeFunctionOnNextCall(v0);
v0(v3);
}
v2();
gc();
assertThrows(function () { v0(2); }, TypeError);