v8/test/mjsunit/compiler/regress-946889.js
Georg Neis 8d6da70857 [turbofan] Fix bug in JSStoreInArrayLiteral
It was missing a control output.

Bug: chromium:946889
Change-Id: I85f203fc6e27a60f0b86e0e2999dd798a5416dfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1547655
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60549}
2019-04-01 11:58:27 +00:00

19 lines
377 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
Object.preventExtensions(Array.prototype);
function foo() {
var arr = [];
[...arr, 42, null];
arr.length = 1;
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();