v8/test/mjsunit/regress/regress-842612.js
Vaclav Brozek be5cfb2295 Fix array.indexOf for negative fromIndex
Array.indexOf accepts an optional fromIndex argument. When non-negative,
this argument restricts the searched indices to those starting at
fromIndex:
[1, 2, 1].indexOf(1,1) == 2
When negative, it is meant to be added to the array length to provide
such initial index for the search:
[1, 2, 1].indexOf(1, -2) == 2

This transformation has been done by the non-optimised builtin but not
by the reducer. The CL adds this construction to the reducer.

Bug: chromium:842612
Change-Id: I0ff089997f4ebb4dc3c2923e52c382a8a96cd711
Reviewed-on: https://chromium-review.googlesource.com/1059628
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Vaclav Brozek <vabr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53197}
2018-05-16 07:31:46 +00:00

17 lines
338 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var arr = [undefined];
function f() {
assertEquals(0, arr.indexOf(undefined, -1));
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();