875ccb48ff
This fixes a missing name check for keyed property loads targeting the
global object where the feedback was warmed up with a single name. This
affects {JSLoadProperty} nodes only, syntactic global property loads via
the {JSLoadGlobal} operator are not affected.
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-694416
BUG=chromium:694416
Change-Id: I54aa3f27eaa72630539f02602ec7642b04835b27
Reviewed-on: https://chromium-review.googlesource.com/445224
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43344}
18 lines
413 B
JavaScript
18 lines
413 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turbo
|
|
|
|
var good = 23;
|
|
var boom = 42;
|
|
|
|
function foo(name) {
|
|
return this[name];
|
|
}
|
|
|
|
assertEquals(23, foo('good'));
|
|
assertEquals(23, foo('good'));
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals(42, foo('boom'));
|