v8/test/mjsunit/regress/regress-631050.js
mlippautz e97b8686f2 [heap] Don't consider mementos on pages below age mark
Objects that reside below the age mark could be on pages that have been moved
within new space. In this case mementos survived which can actually point to
already-collected allocation sites.

BUG=chromium:631050,chromium:581412
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2179033005
Cr-Commit-Position: refs/heads/master@{#38094}
2016-07-27 12:18:16 +00:00

16 lines
352 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --gc-global --stress-runs=8
function __f_3(x, expected) {
var __v_3 = [];
__v_3.length = x;
__f_3(true, 1);
}
try {
__f_3(2147483648, 2147483648);
} catch (e) {}