v8/test/mjsunit/regress/regress-crbug-604680.js
ishell b4dbb2f710 [deoptimizer] Do not modify stack_fp which is used as a key for lookup of previously materialized objects.
BUG=chromium:604680, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1904663003

Cr-Commit-Position: refs/heads/master@{#35693}
2016-04-21 09:54:33 +00:00

46 lines
708 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --harmony-tailcalls
function h() {
var res = g.arguments;
return res;
}
function g(o) {
var res = h();
return res;
}
function f1() {
var o = { x : 42 };
var res = g(o);
return 1;
}
function f0(a, b) {
"use strict";
return f1(5);
}
function boom(b) {
if (b) throw new Error("boom!");
}
%NeverOptimizeFunction(h);
f0();
f0();
%OptimizeFunctionOnNextCall(f0);
boom(false);
boom(false);
%OptimizeFunctionOnNextCall(boom);
try {
f0(1, 2, 3);
boom(true, 1, 2, 3);
} catch (e) {
}