regress-944062-2.js 552 Bytes
Newer Older
1 2 3 4 5 6 7 8 9 10 11
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax

function includes(key, array) {
  // Transition to dictionary mode in the final invocation.
  array.__defineSetter__(key, () => {});
  // Will then read OOB.
  return array.includes(1234);
12 13 14
};
%PrepareFunctionForOptimization(includes);
includes('', []);
15 16 17 18
includes("", []);
%OptimizeFunctionOnNextCall(includes);
includes("", []);
includes("1235", []);