| OLD | NEW |
| 1 // Copyright 2014 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Flags: --allow-natives-syntax | 5 // Flags: --allow-natives-syntax |
| 6 | 6 |
| 7 // The bug 349885 | 7 function foo(a) { |
| 8 return (a[0] >>> 0) > 0; |
| 9 } |
| 8 | 10 |
| 9 function foo(a) { | 11 var a = new Uint32Array([4]); |
| 10 a[292755462] = new Object(); | 12 var b = new Uint32Array([0x80000000]); |
| 11 } | 13 assertTrue(foo(a)); |
| 12 foo(new Array(5)); | 14 assertTrue(foo(a)); |
| 13 foo(new Array(5)); | |
| 14 %OptimizeFunctionOnNextCall(foo); | 15 %OptimizeFunctionOnNextCall(foo); |
| 15 foo(new Array(10)); | 16 assertTrue(foo(b)) |
| OLD | NEW |