15709b5a3e
Bug: v8:8394, v8:8801, v8:9183 Change-Id: Ia5169541ada58bf2bea64e720cae5e5c04617cbd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667001 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#62278}
25 lines
581 B
JavaScript
25 lines
581 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f(v3) {
|
|
Symbol[Symbol.replace] = Object;
|
|
const v8 = {};
|
|
let i = 0;
|
|
do {
|
|
const v12 = v3[3];
|
|
for (let v17 = 0; v17 < 100000; v17++) {
|
|
}
|
|
const v18 = Object();
|
|
function v19(v20, v21, v22) {}
|
|
i++;;
|
|
} while (i < 1);
|
|
const v25 = Object.freeze(v8);
|
|
};
|
|
%PrepareFunctionForOptimization(f);
|
|
f(Object);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(Object);
|