src/third_party/v8/test/mjsunit/regress/regress-crbug-1031479.js

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --interrupt-budget=200 --stack-size=200 --budget-for-feedback-vector-allocation=100 --expose-gc --stress-flush-bytecode

var i = 0;
function main() {
function v0() {
   function v10(a) {
        i++;
        var cur_i = i;
        try {
            // This triggers the use of old closure that was installed in the
            // earlier invocation of v10 and causes an infinite recursion. At
            // some point we throw from here.
            [].e = 1;

            // Throw when the new closure is on the stack to trigger a OSR on
            // the new closure
            if (cur_i == 2) throw 1;
        } catch(v22) {
            // This loop triggers OSR.
            for (const v24 in "c19rXGEC2E") {
            }
        }
   }
   const v25 = v10(1);
   // We install v10's closure here. The bytecode for v10 gets flushed on gc()
   const v21 = Object.defineProperty([].__proto__,"e",{set:v10});
}
const v26 = v0();
// With --stress-flush-bytecode GC flushes the bytecode for v0 and v10
gc();
assertThrows(v0, TypeError);
}
main();