Index: test/mjsunit/regress/regress-5262.js |
diff --git a/test/mjsunit/regress/regress-5262.js b/test/mjsunit/regress/regress-5262.js |
new file mode 100644 |
index 0000000000000000000000000000000000000000..394bb49ca5053ee8a228205ad246e361ebfc800f |
--- /dev/null |
+++ b/test/mjsunit/regress/regress-5262.js |
@@ -0,0 +1,25 @@ |
+// Copyright 2016 the V8 project authors. All rights reserved. |
+// Use of this source code is governed by a BSD-style license that can be |
+// found in the LICENSE file. |
+ |
+// Flags: --ignition --ignition-osr --turbo-from-bytecode --allow-natives-syntax |
+ |
+function g() { return 23 } |
+function h() { return 42 } |
+function boom(o) { o.g = h } |
+function f(osr_and_recurse) { |
+ if (osr_and_recurse) { |
+ for (var i = 0; i < 3; ++i) { |
+ if (i == 1) %OptimizeOsr(); |
+ } |
+ %OptimizeFunctionOnNextCall(f); |
+ f(false); // Trigger tier-up due to recursive call. |
+ boom(this); // Causes a deopt due to below dependency. |
+ var x = g(); // Install dependency on the {g} function. |
+ return x; |
+ } |
+ return 65; |
+} |
+assertEquals(65, f(false)); |
+assertEquals(65, f(false)); |
+assertEquals(42, f(true)); |