1e921daeab
Bug: v8:7790, chromium:1236962 Change-Id: Idd84f7e154cc8977db7aef14d6b999ac929784dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3075363 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#76223}
33 lines
718 B
JavaScript
33 lines
718 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --budget-for-feedback-vector-allocation=0 --interrupt-budget=1000
|
|
|
|
(function() {
|
|
Empty = function() {};
|
|
|
|
var FuncImpl = new Function();
|
|
Func = function() {
|
|
if (FuncImpl === undefined) {
|
|
try {
|
|
FuncImpl = new Function();
|
|
} catch (e) {
|
|
throw new Error('');
|
|
}
|
|
}
|
|
return FuncImpl();
|
|
};
|
|
})();
|
|
|
|
var object = {};
|
|
main = function(unused = true) {
|
|
var func = Func();
|
|
Empty(func & object.a & object.a & object.a & object.a !== 0, '');
|
|
Empty(func & object.a !== 0, '');
|
|
};
|
|
|
|
for (let i = 0; i < 40; i++) {
|
|
main();
|
|
}
|