dfa9fbc599
The bugfix yesterday missed a case (CL
758816f438).
A better approach is to compute the ideal representation of the
value, then check if it can be in-place changed to the
recorded representation.
Bug: chromium:1226988, v8:7790
Change-Id: I90e58b8efb83892c033693a1a0f946b3059a330c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3011162
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75615}
22 lines
413 B
JavaScript
22 lines
413 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --turboprop
|
|
var __v_0 = {
|
|
x: 2,
|
|
y: 1
|
|
};
|
|
function __f_0() {}
|
|
function __f_1() {
|
|
for (var __v_1 = 0; __v_1 < 100000; __v_1++) {
|
|
var __v_2 = __v_0.x + __f_0();
|
|
}
|
|
var __v_3 = [{
|
|
x: 2.5,
|
|
y: 1
|
|
}];
|
|
}
|
|
__f_1();
|
|
__f_1();
|