v8/test/mjsunit/regress/regress-crbug-906220.js
Benedikt Meurer 2bc9d01ed0 [turbofan] Fix negative offset handling in escape analysis.
Bug: chromium:906220
Change-Id: I72547d92ffad4039c22dd7ce2d1438fe85f9c190
Reviewed-on: https://chromium-review.googlesource.com/c/1340292
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57600}
2018-11-19 11:07:38 +00:00

13 lines
371 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() { new Array().pop(); }
assertEquals(undefined, foo());
assertEquals(undefined, foo());
%OptimizeFunctionOnNextCall(foo);
assertEquals(undefined, foo());