v8/test/mjsunit/elide-double-hole-check-11.js
mvstanton 9987221c02 Make sure builtins preserve guarantees about empty element array prototypes.
We have a bottleneck around storing elements in the array and object prototypes,
but the Push() and Unshift() builtins don't respect them.

Fix this exactly to the level of existing support for stores.

BUG=v8:4043
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1066003003

Cr-Commit-Position: refs/heads/master@{#27943}
2015-04-20 15:16:34 +00:00

17 lines
452 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f1(a, i) {
return a[i] + 0.5;
}
var arr = [,0.0,2.5];
assertEquals(0.5, f1(arr, 1));
assertEquals(0.5, f1(arr, 1));
%OptimizeFunctionOnNextCall(f1);
assertEquals(0.5, f1(arr, 1));
Array.prototype.unshift(1.5);
assertEquals(2, f1(arr, 0));