v8/test/mjsunit/regress/regress-365172-2.js
bmeurer@chromium.org 052f9e9b6d Make DescriptorArray::IsMoreGeneralThan() and DescriptorArray::Merge() compatible again.
BUG=365172
LOG=y
TEST=mjsunit/regress/regress-365172-[1-3]
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/255513005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20922 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-24 08:07:14 +00:00

14 lines
360 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --track-field-types
var b1 = {d: 1}; var b2 = {d: 2};
var f1 = {x: 1}; var f2 = {x: 2};
f1.b = b1;
f2.x = {};
b2.d = 4.2;
f2.b = b2;
%TryMigrateInstance(f1);