blob: ebf14e69b3154ad7536dcc4a4c99234a826099ab (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function c4(w, h) {
var size = w * h;
if (size < 0) size = 0;
return new Uint32Array(size);
}
for (var i = 0; i < 3; i++) {
// Computing -0 as the result makes the "size = w * h" multiplication IC
// go into double mode.
c4(0, -1);
}
// Optimize Uint32ConstructFromLength.
for (var i = 0; i < 1000; i++) c4(2, 2);
// This array will have a HeapNumber as its length:
var bomb = c4(2, 2);
function reader(o, i) {
// Dummy try-catch, so that TurboFan is used to optimize this.
try {} catch(e) {}
return o[i];
}
// Optimize reader!
for (var i = 0; i < 3; i++) reader(bomb, 0);
%OptimizeFunctionOnNextCall(reader);
reader(bomb, 0);
for (var i = bomb.length; i < 100; i++) {
assertEquals(undefined, reader(bomb, i));
}
|
