v8/test/mjsunit/regress/regress-463028.js
jarin 9b40c5d0d2 [turbofan] Fix the deopt ids in assignment.
BUG=chromium:463028
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/987733003

Cr-Commit-Position: refs/heads/master@{#27041}
2015-03-06 12:50:47 +00:00

19 lines
366 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var o = {}
Object.defineProperty(o, "z", {
set: function() {
%DeoptimizeFunction(f);
},
});
function f(o) {
return 19 + (void(o.z = 12));
}
f(o);