a0dbaf590a
When we changed FeedbackMetadata to be it's own type instead of a subtype of FixedArray, we missed this check for valid objects in old space. This restores the old behavior during verification. Bug: chromium:862433 Change-Id: Icdb144df4aebc0c6d78a28405c7f53e40b2e1376 Reviewed-on: https://chromium-review.googlesource.com/1134995 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#54408}
10 lines
265 B
JavaScript
10 lines
265 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var arr = [];
|
|
for (var i = 1; i != 390000; ++i) {
|
|
arr.push("f()");
|
|
}
|
|
new Function(arr.join());
|