Index: test/mjsunit/regress/regress-load-elements.js |
diff --git a/test/mjsunit/pixel-array-rounding.js b/test/mjsunit/regress/regress-load-elements.js |
old mode 100755 |
new mode 100644 |
similarity index 80% |
copy from test/mjsunit/pixel-array-rounding.js |
copy to test/mjsunit/regress/regress-load-elements.js |
index 0c307e62e55297faefe3e2ae253e7a344f4ee6c6..02670f395b0266eff47a8ff65b48703febb9e210 |
--- a/test/mjsunit/pixel-array-rounding.js |
+++ b/test/mjsunit/regress/regress-load-elements.js |
@@ -27,18 +27,23 @@ |
// Flags: --allow-natives-syntax |
-var pixels = new Uint8ClampedArray(8); |
- |
-function f() { |
- for (var i = 0; i < 8; i++) { |
- pixels[i] = (i * 1.1); |
+function bad_func(o,a) { |
+ for (var i = 0; i < 1; ++i) { |
+ o.prop = 0; |
+ var x = a[0]; |
} |
- return pixels[1] + pixels[6]; |
} |
-f(); |
-f(); |
-assertEquals(6, pixels[5]); |
-%OptimizeFunctionOnNextCall(f); |
-f(); |
-assertEquals(6, pixels[5]); |
+o = new Object(); |
+a = {}; |
+a[0] = 1; |
+bad_func(o, a); |
+ |
+o = new Object(); |
+bad_func(o, a); |
+ |
+// Optimize, before the fix, the element load and subsequent tagged-to-i were |
Jakob Kummerow
2012/08/30 16:42:03
Outdated comment. At least, s/tagged-to-i/fixed-ar
Toon Verwaest
2012/08/30 17:27:08
Done.
|
+// hoisted above the map check, which can't be hoisted due to the map-changing |
+// store. |
+%OptimizeFunctionOnNextCall(bad_func); |
+bad_func(o, ""); |