Index: test/mjsunit/regress/regress-crbug-134055.js |
diff --git a/test/mjsunit/regress/regress-2170.js b/test/mjsunit/regress/regress-crbug-134055.js |
similarity index 72% |
copy from test/mjsunit/regress/regress-2170.js |
copy to test/mjsunit/regress/regress-crbug-134055.js |
index 01cb1eaf8f7b812429d4f36dee28b70f4af0b66d..9b658fb6f650f04520001f61f8e34d0202c5fb7d 100644 |
--- a/test/mjsunit/regress/regress-2170.js |
+++ b/test/mjsunit/regress/regress-crbug-134055.js |
@@ -27,32 +27,37 @@ |
// Flags: --allow-natives-syntax |
-function array_fun() { |
- for (var i = 0; i < 2; i++) { |
- var a = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8]; |
- var x = new Array(); |
- x.fixed$length = true; |
- for (var j = 0; j < a.length; j++) { |
- x.push(a[j]); |
- } |
- for(var j = 0; j < x.length; j++) { |
- if (typeof x[j] != 'number') { |
- throw "foo"; |
- } |
- x[j] = x[j]; |
- } |
- } |
+function crash(obj) { |
+ return obj.foo; |
} |
-try { |
- for (var i = 0; i < 10; ++i) { |
- array_fun(); |
- } |
- %OptimizeFunctionOnNextCall(array_fun); |
- for (var i = 0; i < 10; ++i) { |
- array_fun(); |
+function base(number_of_properties) { |
+ var result = new Array(); |
+ for (var i = 0; i < number_of_properties; i++) { |
+ result["property" + i] = "value" + i; |
} |
-} catch (e) { |
- assertUnreachable(); |
+ result.foo = number_of_properties; |
+ return result; |
} |
+var a = base(12); |
+var b = base(13); |
+var c = base(14); |
+var d = base(15); |
+ |
+crash(a); // Premonomorphic. |
+crash(a); |
+crash(b); |
+crash(c); |
+crash(d); // Polymorphic, degree 4. |
+ |
+//Prepare ElementsKind transition map chain. |
+var x = base(13); |
+x[0] = "object"; |
+x = base(14); |
+x[0] = "object"; |
+x = base(15); |
+x[0] = "object"; |
+ |
+%OptimizeFunctionOnNextCall(crash); |
+crash(a); |