regress-688690.js 488 Bytes
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

var foo = "01234567";

foo += foo;
foo += foo;
foo += foo;
foo += foo;
foo += foo;  // foo.length = 256;

// Create an adaptor frame, and take the StringReplaceOneCharWithString runtime
// fast path. This crashed originally since TailCallRuntime could not handle
// adaptor frames.
var bar = foo.replace('x', 'y', 'z');