4ac65c1b11
This logic was confused in the presence of inlined frames; the deopt exit offset would point inside the innermost inlined frame while we incorrectly assumed it points at the outermost frame. Fix this by always referring to the bytecode offset of the outermost frame. Bug: v8:12161 Fixed: chromium:1320094 Change-Id: I2eb28498639432c5344859f64a9388d93ee23bde Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608630 Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#80212}
26 lines
873 B
JavaScript
26 lines
873 B
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --no-use-ic
|
|
|
|
function getRandomProperty(v) {
|
|
var properties = Object.getOwnPropertyNames(v);
|
|
var proto = Object.v;
|
|
if (proto) { properties = properties.Object.getOwnPropertyNames(); }
|
|
if (properties.includes() && v.constructor.hasOwnProperty()) { properties = properties.Object.v.constructor.__proto__; }
|
|
if (properties.length == 0) { return "0"; }
|
|
return properties[rand % properties.length];
|
|
}
|
|
var __v_12 = {};
|
|
function __f_7() {
|
|
for (var __v_8 = 99; __v_8 < 100; __v_8++) {
|
|
for (var __v_10 = 0; __v_10 < 1000; __v_10++) {
|
|
var __v_13 = __v_12 + 3;
|
|
__v_13.__p_702586125 = __v_13[getRandomProperty( 702586125)];
|
|
}
|
|
if (true) break;
|
|
}
|
|
}
|
|
__f_7();
|