2631c9f5e3
Reason for revert: This was probably an infrastructure problem caused by the mac ninja/goma switch. Original issue's description: > Revert of Protect the emptiness of Array prototype elements with a PropertyCell. (patchset #7 id:120001 of https://codereview.chromium.org/1092043002/) > > Reason for revert: > MAC GCSTRESS failure on new test. > > Original issue's description: > > Protect the emptiness of Array prototype elements with a PropertyCell. > > > > Not just emptiness, but also a particular structure. > > > > BUG=v8:4044 > > LOG=N > > TBR=jkummerow@chromium.org > NOPRESUBMIT=true > NOTREECHECKS=true > NOTRY=true > BUG=v8:4044 TBR=jkummerow@chromium.org,mvstanton@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:4044 Review URL: https://codereview.chromium.org/1052253003 Cr-Commit-Position: refs/heads/master@{#28000}
24 lines
655 B
JavaScript
24 lines
655 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f1(a, i) {
|
|
return a[i] + 0.5;
|
|
}
|
|
|
|
var other_realm = Realm.create();
|
|
var arr = [,0.0,2.5];
|
|
assertEquals(0.5, f1(arr, 1));
|
|
assertEquals(0.5, f1(arr, 1));
|
|
%OptimizeFunctionOnNextCall(f1);
|
|
assertEquals(0.5, f1(arr, 1));
|
|
|
|
Realm.shared = arr.__proto__;
|
|
|
|
// The call syntax is useful to make sure the native context is that of the
|
|
// other realm.
|
|
Realm.eval(other_realm, "Array.prototype.push.call(Realm.shared, 1);");
|
|
assertEquals(1.5, f1(arr, 0));
|