v8/test/mjsunit/regress/regress-1144672.js
Victor Gomes 18d79f90cf [deoptimizer] Fix define typo and inlined frame base
Change-Id: I81ace5b6abf883c80bea1fada94a66888b16745a
Bug: chromium:1144672, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512923
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70971}
2020-11-04 18:39:04 +00:00

21 lines
445 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function g(b) {
const _ = Object.getOwnPropertyDescriptors(g);
// for (const _ of b) {}
}
function f(...a) {
g(a);
}
%PrepareFunctionForOptimization(f);
%PrepareFunctionForOptimization(g);
f([]);
%OptimizeFunctionOnNextCall(f);
f([]);