13921eb704
ReduceJSToNumeric() can fail to update the node type after changing it's operator to JSToNumeric. BUG=chromium:1158049 Change-Id: Iaabb3676f8ad9563903b81de2e7eecdcc92cbc0b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593336 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#71771}
17 lines
368 B
JavaScript
17 lines
368 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
const v2 = Symbol.unscopables;
|
|
|
|
function v6(v7,v8,v9,v10) {
|
|
try {
|
|
let v11 = eval && v2;
|
|
const v12 = v11++;
|
|
} catch(v13) {}
|
|
}
|
|
|
|
for (let v17 = 1; v17 < 10000; v17++) {
|
|
const v18 = v6();
|
|
}
|