v8/test/mjsunit/compiler/regress-444695.js
Benedikt Meurer 3f00ce2d59 [turbofan] Fix missing ChangeUint32ToUint64 in lowering of LoadBuffer.
TEST=mjsunit/compiler/regress-444695
BUG=chromium:444695
LOG=y
R=hpayer@chromium.org

Review URL: https://codereview.chromium.org/824843002

Cr-Commit-Position: refs/heads/master@{#25932}
2014-12-23 06:54:00 +00:00

12 lines
393 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var foo = (function(stdlib, foreign, heap) {
"use asm";
var MEM = new stdlib.Uint8Array(heap);
function foo(x) { MEM[x | 0] *= 0; }
return {foo: foo};
})(this, {}, new ArrayBuffer(1)).foo;
foo(-926416896 * 8 * 1024);