c9b4f3c4a7
This CL is part of a series that implements Turbofan support for property accesses satisfying the following conditions: 1. The holder is a dictionary mode object. 2. The holder is a prototype. 3. The access is a load. This feature will only be enabled if the build flag v8_dict_property_const_tracking is set. This particular CL modifies existing mjsunit tests whose assumptions don't hold if v8_dict_property_const_tracking is enabled. This is done by adding special handling for the case that %IsDictPropertyConstTrackingEnabled() holds. Bug: v8:11248 Change-Id: Ia36be73e4659a988b2471f0c8151b0442f3a98f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2780292 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#73745}
78 lines
2.2 KiB
JavaScript
78 lines
2.2 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt --noalways-opt
|
|
|
|
// Test that JSResolvePromise takes a proper stability dependency
|
|
// on the resolutions map if the infer receiver maps are unreliable
|
|
// (as is the case for HeapConstants).
|
|
(function() {
|
|
// We need an object literal which gets a stable map initially.
|
|
function makeObjectWithStableMap() {
|
|
return {a:1, b:1, c:1};
|
|
}
|
|
const a = makeObjectWithStableMap();
|
|
|
|
function foo() {
|
|
return Promise.resolve(a);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertInstanceof(foo(), Promise);
|
|
assertInstanceof(foo(), Promise);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertInstanceof(foo(), Promise);
|
|
assertOptimized(foo);
|
|
|
|
// Now invalidate the stability of a's map.
|
|
const b = makeObjectWithStableMap();
|
|
b.d = 1;
|
|
|
|
if (%IsDictPropertyConstTrackingEnabled()) {
|
|
// TODO(v8:11457) In this mode we weren't able to inline the access, yet, so
|
|
// it stays optimized. See related TODO in
|
|
// JSNativeContextSpecialization::ReduceJSResolvePromise.
|
|
return;
|
|
}
|
|
|
|
// This should deoptimize foo.
|
|
assertUnoptimized(foo);
|
|
})();
|
|
|
|
// Same test with async functions.
|
|
(function() {
|
|
// We need an object literal which gets a stable map initially,
|
|
// it needs to be different from the above, otherwise the map
|
|
// is already not stable when we get here.
|
|
function makeObjectWithStableMap() {
|
|
return {x:1, y:1};
|
|
}
|
|
const a = makeObjectWithStableMap();
|
|
|
|
async function foo() {
|
|
return a;
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertInstanceof(foo(), Promise);
|
|
assertInstanceof(foo(), Promise);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertInstanceof(foo(), Promise);
|
|
assertOptimized(foo);
|
|
|
|
// Now invalidate the stability of a's map.
|
|
const b = makeObjectWithStableMap();
|
|
b.z = 1;
|
|
|
|
if (%IsDictPropertyConstTrackingEnabled()) {
|
|
// TODO(v8:11457) In this mode we weren't able to inline the access, yet, so
|
|
// it stays optimized. See related TODO in
|
|
// JSNativeContextSpecialization::ReduceJSResolvePromise.
|
|
return;
|
|
}
|
|
|
|
// This should deoptimize foo.
|
|
assertUnoptimized(foo);
|
|
})();
|