v8/test/mjsunit/regress/regress-775888.js
Daniel Clifford 0454a842d1 Ensure inlined Array.protoype.shift() calls return non-COW arrays
Also ensure that CSA's CloneFixedArray and ExtractFixedArray correctly
transition COW to non-COW maps when doing a clone requiring copying.

Bug: chromium:775888
Change-Id: I31c97072761fdd2360d86f840c9fd6ab2d72973a
Reviewed-on: https://chromium-review.googlesource.com/727900
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48754}
2017-10-19 15:05:44 +00:00

22 lines
464 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function __f_7586(__v_27535) {
let a = __v_27535.shift();
return a;
}
function __f_7587() {
var __v_27536 = [ 1, 15, 16];
__f_7586(__v_27536);
__v_27536.unshift(__v_27536);
}
__f_7587();
__f_7587();
%OptimizeFunctionOnNextCall(__f_7586);
__f_7587();