v8/test/mjsunit/regress/regress-610633.js
gsathya d33aedb7b9 Revert "Fix TypedArray Property optimizations", add regression test and eliminate dead code
This reverts commit 41d571dfe8.

Reason for revert: This patch breaks the correctness of the typedarray
properties such as length, byteOffset, byteLength.

The accessor check optimization code is dead code eliminated. A follow
up patch will fix this optimization correctly.

BUG=chromium:593634

Review-Url: https://codereview.chromium.org/1977983002
Cr-Commit-Position: refs/heads/master@{#36254}
2016-05-13 22:31:07 +00:00

41 lines
846 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function getLength(a) {
return a.length;
}
function getByteLength(a) {
return a.byteLength;
}
function getByteOffset(a) {
return a.byteOffset;
}
var a = new Uint8Array([1, 2, 3]);
getLength(a);
getLength(a);
Object.defineProperty(a.__proto__, 'length', {value: 42});
assertEquals(42, getLength(a));
assertEquals(42, a.length);
getByteLength(a);
getByteLength(a);
Object.defineProperty(a.__proto__, 'byteLength', {value: 42});
assertEquals(42, getByteLength(a));
assertEquals(42, a.byteLength);
getByteOffset(a);
getByteOffset(a);
Object.defineProperty(a.__proto__, 'byteOffset', {value: 42});
assertEquals(42, getByteOffset(a));
assertEquals(42, a.byteOffset);