d9cff61e56
Bug: v8:8394 Change-Id: I5b4c02f5f36710b3fa15037e1fa1520b759447c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611798 Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#61501}
20 lines
519 B
JavaScript
20 lines
519 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt
|
|
|
|
function foo() {
|
|
const a = [];
|
|
a[0] = 1;
|
|
return a[0];
|
|
}
|
|
|
|
%EnsureFeedbackVectorForFunction(foo);
|
|
Object.setPrototypeOf(Array.prototype, new Int8Array());
|
|
assertEquals(undefined, foo());
|
|
assertEquals(undefined, foo());
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals(undefined, foo());
|
|
assertOptimized(foo);
|