node/deps/v8/test/mjsunit/regress/regress-crbug-1163184.js
Michaël Zasso c5ff019a4e
deps: update V8 to 8.9.255.19
PR-URL: https://github.com/nodejs/node/pull/37330
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
2021-02-25 00:14:47 +01:00

30 lines
945 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --stress-compact
let arr = [20];
// This forces arr.concat to create a new dictionary map which can be collected
// on a GC.
arr[Symbol.isConcatSpreadable] = true;
for (let i = 0; i < 4; ++i) {
function tmp() {
// Creates a new map that is collected on a GC.
let c = arr.concat();
// Access something from c, so c's map is embedded in code object.
c.x;
};
%PrepareFunctionForOptimization(tmp);
tmp();
// Optimize on the second iteration, so the optimized code isn't function
// context specialized and installed on feedback vector.
if (i == 1) {
%OptimizeFunctionOnNextCall(tmp);
tmp();
}
// Simulate full Newspace, so on next closure creation we cause a GC.
if (i == 2) %SimulateNewspaceFull();
}