[Webkit-unassigned] [Bug 228919] New single bytecode loop for-in is missing many inline asm optimizations in 32bit

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=228919

Mikhail R. Gadelha <mikhail at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #435770|for-in-undefined.js         |for-in-infinite-loop.js
           filename|                            |
 Attachment #435770|testcase                    |for-in-infinite-loop.js
        description|                            |

--- Comment #4 from Mikhail R. Gadelha <mikhail at igalia.com> ---
Comment on attachment 435770
  --> https://bugs.webkit.org/attachment.cgi?id=435770
for-in-infinite-loop.js

function makeobj(n) {
  var obj = {};
  for (var i = 0; i < n; ++i)
    obj[i] = i;
  return obj;
}

function testdelete(n) {
  for (var propToDelete = 0; propToDelete <= n; ++propToDelete) {
    for (var iterToDelete = 0; iterToDelete <= n; ++iterToDelete) {
      for (var iterToAdd = 0; iterToAdd <= n; ++iterToAdd) {

        print("testing with " + n + " properties");
        print("deleting property number " + propToDelete + " on iteration " +
              iterToDelete);
        print("adding a property on iteration " + iterToAdd);

        var iter = 0;
        var o = makeobj(n);

        for (var i in o) {
          if (iter == iterToDelete)
            delete o[propToDelete];

          if (iter == iterToAdd)
            o["xxx"] = 1;

          // print("iter: " + iter + "i: " + i);
          print(i)

          ++ iter;
        }
      }
    }
  }
}

testdelete(6);

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210818/1e20184c/attachment-0001.htm>