node/deps/v8/test/mjsunit/regress/regress-crbug-523213.js
Ali Ijaz Sheikh 8a43a3d761 deps: upgrade V8 to 4.7.80.24
Pick up the latest branch head for V8 4.7:
be169f8df0

Full change history for the 4.7 branch:
https://chromium.googlesource.com/v8/v8.git/+log/branch-heads/4.7

V8 blog post about what is new on V8 4.7:
http://v8project.blogspot.de/2015/10/v8-release-47.html

PR-URL: https://github.com/nodejs/node/pull/4106
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: rvagg - Rod Vagg <rod@vagg.org>
2015-12-04 00:06:01 -08:00

22 lines
379 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var v1 = [];
var v2 = [];
v1.__proto__ = v2;
function f(){
var a = [];
for(var i=0; i<2; i++){
a.push([]);
a = v2;
}
}
f();
%OptimizeFunctionOnNextCall(f);
f();