blob: ce61e4ebdec448c99c35a50e6847a585bb336a40 [file] [edit]
// Regression test for the DFG VirtualRegisterAllocationPhase crash that
// happened when the fast Array iterator entries path emitted GetByVal on a
// Double-storage array followed by NewArray with no intervening ExitOK,
// causing Fixup to insert the ValueRep conversion before the GetByVal that
// produced its operand.
function inner(iterator) {
for (const item of iterator) { }
}
function driver() {
const values = [268435456, 4294967295, 268435456, 268435456, 268435456];
const iterator = values.entries();
for (let i = 0; i < 100; ++i)
inner(iterator);
}
for (let i = 0; i < testLoopCount; ++i)
driver();