34225a6afb
For spread calls with arrays with double elements but zero length, we skip the box-as-heapnumber step; so in this corner case the Call builtin sees a FixedDoubleArray, which is fine because it doesn't read any of the raw double values from it. This patch doesn't change the implementation, it only updates the assert to match reality. Bug: chromium:856095 Change-Id: I0227f4ccbc6c61c8f5f7669a266ef7a64c6a9a43 Reviewed-on: https://chromium-review.googlesource.com/1117922 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#54149}
15 lines
293 B
JavaScript
15 lines
293 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function f(a, b, c) { }
|
|
function a() {
|
|
let o1;
|
|
o1 = new Array();
|
|
f(...o1);
|
|
o1[1000] = Infinity;
|
|
}
|
|
|
|
a();
|
|
a();
|