v8/test/mjsunit/regress-1120905.js
Victor Gomes a695cb403c [test] Add short copyright to regress-1120905.js
Change-Id: I49dbd52b9019b1da94dfa91c73116e827ce74ca4
Bug: chromium:1120905, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377689
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69592}
2020-08-27 20:58:05 +00:00

31 lines
587 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function O() {}
O.prototype.f = f;
O.prototype.g = g;
function f() {
return g.arguments;
}
function g(x) {
return this.f(2 - x, "any");
}
var o = new O();
function foo(x) {
return o.g(x, "z");
}
for (var i = 0; i < 35; i++) foo();
var result = (
%PrepareFunctionForOptimization(foo),foo(), foo(),
%OptimizeFunctionOnNextCall(foo), foo()
);
assertEquals(result[1], "z");