diff options
Diffstat (limited to 'deps/v8/test/mjsunit/regress/regress-crbug-650404.js')
-rw-r--r-- | deps/v8/test/mjsunit/regress/regress-crbug-650404.js | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-650404.js b/deps/v8/test/mjsunit/regress/regress-crbug-650404.js new file mode 100644 index 0000000000..ebf14e69b3 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-crbug-650404.js @@ -0,0 +1,36 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function c4(w, h) { + var size = w * h; + if (size < 0) size = 0; + return new Uint32Array(size); +} + +for (var i = 0; i < 3; i++) { + // Computing -0 as the result makes the "size = w * h" multiplication IC + // go into double mode. + c4(0, -1); +} +// Optimize Uint32ConstructFromLength. +for (var i = 0; i < 1000; i++) c4(2, 2); + +// This array will have a HeapNumber as its length: +var bomb = c4(2, 2); + +function reader(o, i) { + // Dummy try-catch, so that TurboFan is used to optimize this. + try {} catch(e) {} + return o[i]; +} +// Optimize reader! +for (var i = 0; i < 3; i++) reader(bomb, 0); +%OptimizeFunctionOnNextCall(reader); +reader(bomb, 0); + +for (var i = bomb.length; i < 100; i++) { + assertEquals(undefined, reader(bomb, i)); +} |