v8/test/mjsunit/regress/regress-1380398.js
Nico Hartmann 2caf5d18db [turbofan] Fix incorrect size shift computation for DataViews
Bug: v8:11111, chromium:1380398, chromium:1380990
Change-Id: I99ee88341d1119d1372210741ddccb0e2cd33bf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4002688
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84045}
2022-11-03 15:55:17 +00:00

20 lines
555 B
JavaScript

// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turbofan --harmony-rab-gsab
function test() {
const ab = new ArrayBuffer(2996, { maxByteLength: 8588995 });
const dv = new DataView(ab);
const len = dv.byteLength;
return len >= 255;
}
%PrepareFunctionForOptimization(test);
assertTrue(test());
assertTrue(test());
%OptimizeFunctionOnNextCall(test);
assertTrue(test());
assertOptimized(test);