forked from LeenkxTeam/Kmake
26 lines
1.1 KiB
JavaScript
26 lines
1.1 KiB
JavaScript
|
// Copyright 2024 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
//
|
||
|
|
// Flags: --allow-natives-syntax --no-lazy-feedback-allocation --single-threaded
|
||
|
|
|
||
|
|
var e;
|
||
|
|
function foo() {
|
||
|
|
for (let v0 = 0; v0 < 5; v0++) {
|
||
|
|
const v1 = %OptimizeOsr(); // Force Osr'ing, v1 = undefined
|
||
|
|
const v2 = v1 | v1; // v2 = 0
|
||
|
|
const v3 = v2 ** v2; // v3 = 1 (HeapNumber on interpreter,
|
||
|
|
// Smi on Maglev due to Canonicalization)
|
||
|
|
e = v3; // The first time we are running the loop, we are
|
||
|
|
// still on the interpreter, it will set {e} is
|
||
|
|
// global constant with value HeapNumber 1.
|
||
|
|
// Maglev then adds the assumption that v3 is a
|
||
|
|
// HeapNumber, based on the feedback.
|
||
|
|
for (const v4 in v3) { // Crash in ToObject call on Maglev since we
|
||
|
|
} // assume it isnot an Smi.
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
%PrepareFunctionForOptimization(foo);
|
||
|
|
foo();
|