v8/test/mjsunit/regress/regress-crbug-770543.js
Michael Starzinger 631489bd39 [deoptimizer] Fix TranslatedState inline frame indexing.
This makes sure that helper methods on the {TranslatedState} class stick
to the counting scheme used by {OptimizedFrame::Summarize} within the
stack-walker. Both now treat {kJavaScriptBuiltinContinuation} as real
JavaScript frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-770543
BUG=chromium:770543

Change-Id: Icda65a7efb487470d39ebf648767a488ebf2e5f1
Reviewed-on: https://chromium-review.googlesource.com/695123
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48264}
2017-10-02 14:14:30 +00:00

32 lines
620 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function FunctionCallerFromInlinedBuiltin() {
function f() {
function g() {
Object.getOwnPropertyDescriptor(g, "caller");
};
[0].forEach(g);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();
})();
(function FunctionArgumentsFromInlinedBuiltin() {
function g() {
g.arguments;
}
function f() {
[0].forEach(g);
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();
})();