Upload Kmake

deps/v8/test/mjsunit/regress/regress-crbug-325020448.js

@@ -0,0 +1,36 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var p1 = {}
+var p2 = {}
+function foo() {}
+var o1 = new foo();
+
+// Pre-seed 3 maps where con is constant
+o1.con = 1;
+o1.__proto__ = p1;
+o1.__proto__ = p2;
+
+// The o.con store only clears constness of the middle map. Both
+// proto transitions above and below do not propagate the constness
+// change. Thus both loads at the bottom and top seem to be reading
+// from the same constant field.
+function t1(o) {
+  var a = o.con;
+  o.__proto__ = p1;
+  o.con = 2;
+  o.__proto__ = p2;
+  return a + o.con;
+}
+function t2() {
+  var o = new foo();
+  o.con = 1;
+  return t1(o);
+}
+%PrepareFunctionForOptimization(t1);
+assertTrue(t2() == 3);
+%OptimizeFunctionOnNextCall(t1);
+assertTrue(t2() == 3);