v8/test/mjsunit/regress/regress-5790.js
bmeurer 380a0207db [crankshaft] Don't bailout on uninitialized access to arguments object.
When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790

Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}
2017-01-02 06:52:04 +00:00

21 lines
437 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(a) {
"use strict";
if (a) return arguments[1];
}
foo(false);
foo(false);
%OptimizeFunctionOnNextCall(foo);
foo(true, 1);
foo(true, 1);
%OptimizeFunctionOnNextCall(foo);
foo(false);
foo(true, 1);
assertOptimized(foo);