node/deps/v8/test/mjsunit/regress/regress-crbug-1024758.js
Myles Borins ea2668d2db
deps: patch V8 to 7.9.317.25
Refs: https://github.com/v8/v8/compare/7.9.317.23...7.9.317.25

PR-URL: https://github.com/nodejs/node/pull/30679
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2019-11-30 01:26:32 +01:00

38 lines
725 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --allow-natives-syntax
function f() {
return r.test("abc");
}
function to_dict(o) {
r.a = 42;
r.b = 42;
delete r.a;
}
function to_fast(o) {
const obj = {};
const obj2 = {};
delete o.a;
obj.__proto__ = o;
obj[0] = 1;
obj.__proto__ = obj2;
delete obj[0];
return o;
}
// Shrink the instance size by first transitioning to dictionary properties,
// then back to fast properties.
const r = /./;
to_dict(r);
to_fast(r);
%PrepareFunctionForOptimization(f);
assertTrue(f());
%OptimizeFunctionOnNextCall(f);
assertTrue(f());