v8/test/mjsunit/compiler/regress-bound-functions.js
Maya Lekova 48fb778e2d [turbofan] Fix memory corruption with VirtualBoundFunctions
Bug: chromium:1018565
Change-Id: I72d41573a9a8c2f1a235ff50e918f89b1dc3f585
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879904
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64588}
2019-10-28 13:20:16 +00:00

21 lines
429 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
return Array.prototype.sort.bind([]);
}
function bar() {
return foo();
}
%PrepareFunctionForOptimization(foo);
%PrepareFunctionForOptimization(bar);
bar();
bar();
%OptimizeFunctionOnNextCall(bar);
bar();