6744ff61ae
Using FAST_SMI_ELEMENTS triggers optimization on 64-bit architectures that load only the higher 32 bits of the element. If the element is a pointer to undefined that has 0 in the higher half than it is erroneously treated as SMI 0. BUG=v8:3158 LOG=N TEST=mjsunit/sparse-array-reverse,mjsunit/regress/regress-3158.js R=danno@chromium.org, ishell@chromium.org Review URL: https://codereview.chromium.org/166653005 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19387 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
25 lines
482 B
JavaScript
25 lines
482 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --allow-natives-syntax
|
|
|
|
Array.prototype[0] = 'a';
|
|
delete Array.prototype[0];
|
|
|
|
function foo(a, i) {
|
|
return a[i];
|
|
}
|
|
|
|
var a = new Array(100000);
|
|
a[3] = 'x';
|
|
|
|
foo(a, 3);
|
|
foo(a, 3);
|
|
foo(a, 3);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(a, 3);
|
|
Array.prototype[0] = 'a';
|
|
var z = foo(a, 0);
|
|
assertEquals('a', z);
|