d86038db25
Crankshaft just unconditionally deoptimizes the code when the length of a string addition result would overflow. In order to protect against deopt loops we insert a global protector cell. We will use the same mechanism for inlining certain string additions into TurboFan as well, and protecting against overflow (we will also extend this to deal with String.prototype.concat and friends once we get there). BUG=v8:5404 R=jarin@chromium.org,hpayer@chromium.org CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_msan_rel Committed: https://crrev.com/cb19257a926a55209a6d6858ce26d51a0447ba71 Review-Url: https://codereview.chromium.org/2348293002 Cr-Original-Commit-Position: refs/heads/master@{#39511} Cr-Commit-Position: refs/heads/master@{#39525}
22 lines
485 B
JavaScript
22 lines
485 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(a, b) {
|
|
return a + "0123456789012";
|
|
}
|
|
|
|
foo("a");
|
|
foo("a");
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo("a");
|
|
|
|
var a = "a".repeat(268435440);
|
|
assertThrows(function() { foo(a); });
|
|
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertThrows(function() { foo(a); });
|
|
assertOptimized(foo);
|