node/deps/v8/test/mjsunit/regress/regress-bce-underflow.js
Michaël Zasso e31f0a7d25
deps: update V8 to 7.7.299.4
PR-URL: https://github.com/nodejs/node/pull/28918
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
2019-08-19 09:25:23 +02:00

37 lines
789 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(a, i, bool) {
var result;
if (bool) {
// Make sure i - -0x80000000 doesn't overflow in BCE, missing a check for
// x-0 later on.
result = f2(a, 0x7fffffff, i, i, -0x80000000);
} else {
result = f2(a, -3, 4, i, 0);
}
return result;
}
%PrepareFunctionForOptimization(f);
function f2(a, c, x, i, d) {
return a[x + c] + a[x - 0] + a[i - d];
}
var a = [];
var i = 0;
a.push(i++);
a.push(i++);
a.push(i++);
a.push(i++);
a.push(i++);
f(a, 0, false);
f(a, 0, false);
f(a, 0, false);
%OptimizeFunctionOnNextCall(f);
%DebugPrint(f(a, -0x7fffffff, true));