OLD | NEW |
1 // Copyright 2016 the V8 project authors. All rights reserved. | 1 // Copyright 2016 the V8 project authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Flags: --allow-natives-syntax | 5 // Flags: --allow-natives-syntax |
6 | 6 |
7 function f(arr, i) { | 7 // Make the Object prototype have dictionary properties. |
8 arr[i] = 50; | 8 for (var i = 0; i < 2000; i++) { |
| 9 Object.prototype['X'+i] = true; |
9 } | 10 } |
10 | 11 |
11 function boom(dummy) { | 12 function boom(a1) { |
12 var arr = new Array(10); | 13 return a1[0]; |
13 f(arr, 10); | |
14 if (dummy) { | |
15 f(arr, -2147483648); | |
16 } | |
17 } | 14 } |
18 | 15 |
19 boom(false); | 16 var a = new Array(1); |
| 17 a[0] = 0.1; |
| 18 boom(a); |
| 19 boom(a); |
20 %OptimizeFunctionOnNextCall(boom); | 20 %OptimizeFunctionOnNextCall(boom); |
21 boom(false); | 21 boom(a); |
OLD | NEW |