5636d54c15
If a loop is removed in dead code elimination, we may have a dead node in the control chain. This wasn't expected, and endless recursion could result. Bug: chromium:1196185 Change-Id: Id6d69d0eaed11b0c6158b5643d3433b11611af59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817792 Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#73906}
47 lines
874 B
JavaScript
47 lines
874 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --disable-in-process-stack-traces
|
|
// Flags: --gc-interval=500 --stress-compaction
|
|
|
|
class X {}
|
|
function rando() {}
|
|
|
|
let named;
|
|
function foo(input) {
|
|
var b;
|
|
rando(), {
|
|
blah: function () { b = b(); },
|
|
};
|
|
|
|
for (var i = 0; i < 10; i++) {
|
|
var r = rando();
|
|
var broom;
|
|
|
|
try {
|
|
input[r];
|
|
named();
|
|
} catch (e) {}
|
|
|
|
try {
|
|
broom = __v_859.exports.main;
|
|
} catch (e) {}
|
|
|
|
try {
|
|
for (var j = 0; j < 10; j++) {
|
|
broom();
|
|
}
|
|
} catch (e) {}
|
|
}
|
|
}
|
|
|
|
function testfunc() {
|
|
for (var i = 0; i < 10; i++) {
|
|
%PrepareFunctionForOptimization(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
}
|
|
}
|
|
testfunc();
|