bug1765249.js (843B)
1 // |jit-test| --fast-warmup; --no-threads 2 3 function main() { 4 // Disable Warp compilation, so we don't inline |f|. 5 with ({}) {} 6 7 let begin = 0; 8 for (let i = 1; i < 30; i++) { 9 f(begin); 10 begin = undefined; 11 } 12 } 13 main(); 14 15 function g(i) { 16 return i < 3; 17 } 18 19 function f(begin) { 20 // Loop body is only reachable on the first invocation. 21 for (let i = begin; i < 5; i++) { 22 // |arguments| with out-of-bounds access. This adds a guard on the prototype 23 // of the arguments object. 24 arguments[100]; 25 26 // Loop with a call expression. This ensures we emit bail instructions for 27 // unreachable code after the first invocation. 28 for (let j = 0; g(j); j++) {} 29 30 // Change the prototype of the arguments object. This will cause a failure 31 // on the prototype guard added above. 32 arguments.__proto__ = {}; 33 } 34 }