node/deps/v8/test/mjsunit/regress/regress-crbug-1035331.js
Matheus Marchini 2883c855e0
deps: update V8 to 8.1.307.20
PR-URL: https://github.com/nodejs/node/pull/32116
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
2020-03-18 16:23:22 -07:00

20 lines
492 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc
const obj = new class C extends async function () {}.constructor {}();
delete obj.name;
Number.prototype.__proto__ = obj;
function foo() {
return obj.bind();
}
%PrepareFunctionForOptimization(foo);
foo();
obj[undefined] = Map, gc();
%OptimizeFunctionOnNextCall(foo);
foo();