v8/test/mjsunit/regress/regress-1034449.js
Nico Hartmann 86a6ce454b [turbofan] Fixes Array constructor with single string argument
Bug: chromium:1034449
Change-Id: Id121b60af0c8c8621464f15aa754056cecb04595
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2064985
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66386}
2020-02-21 12:26:09 +00:00

30 lines
774 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt --no-always-opt
function f(len) {
return new Array(len);
}
%PrepareFunctionForOptimization(f);
assertEquals(3, f(3).length);
assertEquals(18, f(18).length);
%OptimizeFunctionOnNextCall(f);
assertEquals(4, f(4).length);
assertOptimized(f);
let a = f("8");
assertUnoptimized(f);
assertEquals(1, a.length);
assertEquals("8", a[0]);
// Check there is no deopt loop.
%PrepareFunctionForOptimization(f);
assertEquals(1, f(1).length);
%OptimizeFunctionOnNextCall(f);
assertEquals(8, f(8).length);
assertOptimized(f);
assertEquals(1, f("8").length);
assertOptimized(f);