| function foo() { |
| var result = 0; |
| for (var i = 0; i < arguments.length; ++i) |
| result += arguments[i]; |
| return result; |
| } |
| |
| function bar() { |
| return foo.apply(this, arguments); |
| } |
| |
| function baz(p) { |
| if (p) |
| return bar(1, 42); |
| return 0; |
| } |
| |
| noInline(baz); |
| |
| // Execute baz() once with p set, so that the call has a valid prediction. |
| baz(true); |
| |
| // Warm up profiling in bar and foo. Convince this profiling that bar()'s varargs call will tend to |
| // pass a small number of arguments; |
| for (var i = 0; i < 1000; ++i) |
| bar(1); |
| |
| // Now compile baz(), but don't run the bad code yet. |
| for (var i = 0; i < 10000; ++i) |
| baz(false); |
| |
| // Finally, trigger the bug. |
| var result = baz(true); |
| if (result != 43) |
| throw "Error: bad result: " + result; |
