v8/test/mjsunit/regress/regress-crbug-776511.js
Mike Stanton b3d849905e [Turbofan] Reland Array.prototype.filter inlining.
Support inlining of Array.prototype.filter in TurboFan.

Bug: v8:1956
Change-Id: If50e230d14461063d378c0591dc27dea43371afa
Reviewed-on: https://chromium-review.googlesource.com/733089
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48846}
2017-10-23 19:29:50 +00:00

36 lines
1.1 KiB
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --enable-slow-asserts --expose-gc --allow-natives-syntax
function __getProperties(obj) {
let properties = [];
for (let name of Object.getOwnPropertyNames(obj)) {
properties.push(name);
}
return properties;
}
function __getRandomProperty(obj, seed) {
let properties = __getProperties(obj);
return properties[seed % properties.length];
}
(function() {
var __v_59904 = [12, 13, 14, 16, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25];
var __v_59906 = function(__v_59908) {
var __v_59909 = function(__v_59910, __v_59911) {
if (__v_59911 == 13 && __v_59908) {
__v_59904.abc = 25;
}
return true;
};
return __v_59904.filter(__v_59909);
};
print(__v_59906());
__v_59904[__getRandomProperty(__v_59904, 366855)] = this, gc();
print(__v_59906());
%OptimizeFunctionOnNextCall(__v_59906);
var __v_59907 = __v_59906(true);
print(__v_59907);
})();