d93c906acc
We incorrectly mark a KeyedStoreIC miss as a monomorphic prototype failure even though it's the first time a particular (string) key has been seen. BUG=358088 R=verwaest@chromium.org LOG=N Review URL: https://codereview.chromium.org/219313002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20407 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
19 lines
449 B
JavaScript
19 lines
449 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function f(a) {
|
|
a[a.length] = 1;
|
|
}
|
|
|
|
function g(a, i, v) {
|
|
a[i] = v;
|
|
}
|
|
|
|
f([]); // f KeyedStoreIC goes to 1.GROW
|
|
o = {};
|
|
g(o); // We've added property "undefined" to o
|
|
|
|
o = {}; // A transition on property "undefined" exists from {}
|
|
f(o); // Store should go generic.
|