v8/test/mjsunit/regress/regress-crbug-500435.js
bmeurer 45439b92e7 [crankshaft] Fix wrong bailout points in for-in loop body.
R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}
2015-06-16 08:08:42 +00:00

23 lines
405 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function bar(a) {
delete a[1];
}
function foo(a) {
var d;
for (d in a) {
assertFalse(d === undefined);
bar(a);
}
}
foo([1,2]);
foo([2,3]);
%OptimizeFunctionOnNextCall(foo);
foo([1,2]);