d755611e93
Comparing one CallIC::State to another was not done correctly, leading to a failure to patch a CallIC when transitioning from monomorphic Array to megamorphic. BUG=chromium:377198,chromium:377290 LOG=Y R=jkummerow@chromium.org Review URL: https://codereview.chromium.org/305493003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21499 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
18 lines
477 B
JavaScript
18 lines
477 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc
|
|
|
|
Object.prototype.__defineGetter__('constructor', function() { throw 42; });
|
|
__v_7 = [
|
|
function() { [].push() },
|
|
];
|
|
for (var __v_6 = 0; __v_6 < 5; ++__v_6) {
|
|
for (var __v_8 in __v_7) {
|
|
print(__v_8, " -> ", __v_7[__v_8]);
|
|
gc();
|
|
try { __v_7[__v_8](); } catch (e) {};
|
|
}
|
|
}
|