4ed27fc836
When lowering Array.prototype.push/.pop to the fast inlined version, we first need to ensure that all prototypes (including the Object.prototype) are stable. R=mvstanton@chromium.org BUG=chromium:644689 Review-Url: https://codereview.chromium.org/2319533005 Cr-Commit-Position: refs/heads/master@{#39266}
15 lines
352 B
JavaScript
15 lines
352 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
|
|
|
|
function foo() { [].push(1); }
|
|
|
|
foo();
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|