v8/test/mjsunit/regress/regress-7740.js
Georg Neis fc36cacd17 [compiler] Fix bug in representation changer.
We must not accept something of kBit representation as of
kWord32 representation (unless it's truncated accordingly).
Deopt instead.

Bug: v8:7740
Change-Id: Ib4f73600d66f8762a6e22f7ea1ce79e8ef451b34
Reviewed-on: https://chromium-review.googlesource.com/1054670
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53144}
2018-05-14 10:16:22 +00:00

19 lines
357 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var x = 0;
x = 42;
function foo(a, b) {
let y = a < a;
if (b) x = y;
}
foo(1, false);
foo(1, false);
%OptimizeFunctionOnNextCall(foo);
foo(1, true);