v8/test/mjsunit/regress/regress-v8-5697.js
ishell e7a51fff24 [ic] Ensure state of load/store ICs always progresses.
... even when a receiver is not an object.

BUG=v8:5697

Review-Url: https://codereview.chromium.org/2548753003
Cr-Commit-Position: refs/heads/master@{#41458}
2016-12-02 15:07:31 +00:00

27 lines
509 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function load(o) { return o.x; }
for (var x = 0; x < 1000; ++x) {
load({x});
load({x});
try { load(); } catch (e) { }
}
assertOptimized(load);
function store(o) { o.x = -1; }
for (var x = 0; x < 1000; ++x) {
store({x});
store({x});
try { store(); } catch (e) { }
}
assertOptimized(store);