6d0078e4f8
Bug: chromium:958725 Change-Id: I02d2f3ad19fa60482f8fdd8a539205091f428b68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1594434 Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#61196}
26 lines
548 B
JavaScript
26 lines
548 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f(v3) {
|
|
Symbol[Symbol.replace] = Object;
|
|
const v8 = {};
|
|
let i = 0;
|
|
do {
|
|
const v12 = v3[3];
|
|
for (let v17 = 0; v17 < 100000; v17++) {
|
|
}
|
|
const v18 = Object();
|
|
function v19(v20,v21,v22) {
|
|
}
|
|
i++;;
|
|
} while (i < 1);
|
|
const v25 = Object.freeze(v8);
|
|
}
|
|
|
|
f(Object);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(Object);
|