Upgrade to 3.29
Update V8 to 3.29.88.17 and update makefiles to support building on
all the relevant platforms.
Bug: 17370214
Change-Id: Ia3407c157fd8d72a93e23d8318ccaf6ecf77fa4e
diff --git a/test/mjsunit/regress/regress-359491.js b/test/mjsunit/regress/regress-359491.js
new file mode 100644
index 0000000..d72875a
--- /dev/null
+++ b/test/mjsunit/regress/regress-359491.js
@@ -0,0 +1,61 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f("a", "b", 1);
+ f("c", "d", 1);
+ f("a", "b", 0);
+ f("c", "d", 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f({ a : 1}, {b : 1}, 1);
+ f({ c : 1}, {d : 1}, 1);
+ f({ a : 1}, {c : 1}, 0);
+ f({ b : 1}, {d : 1}, 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();