3f9f1eeefa
Inline DependOnStablePrototypeChain to iterate only those maps which share a validity cell with the receiver map. This resolves an issue where maps after the holder object violate the stability invariants, but doesn't require looking up what the actual holder is. Bug: v8:7700 Change-Id: Id06f0d13660f547e14dd25085799c0e6223c34b9 Fixed: chromium:1359215 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871298 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#82964}
37 lines
806 B
JavaScript
37 lines
806 B
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --maglev --allow-natives-syntax
|
|
|
|
function foo(bar) {
|
|
return bar.func();
|
|
}
|
|
class Bar {
|
|
func() {}
|
|
}
|
|
Bar.prototype.__proto__ = new Proxy(Bar.prototype.__proto__, {
|
|
get() {;
|
|
return "42";
|
|
}
|
|
});
|
|
%PrepareFunctionForOptimization(foo);
|
|
foo(new Bar());
|
|
foo(new Bar());
|
|
%OptimizeMaglevOnNextCall(foo);
|
|
foo(new Bar());
|
|
|
|
function foo_primitive(s) {
|
|
return s.substring();
|
|
}
|
|
String.prototype.__proto__ = new Proxy(String.prototype.__proto__, {
|
|
get() {;
|
|
return "42";
|
|
}
|
|
});
|
|
%PrepareFunctionForOptimization(foo_primitive);
|
|
foo_primitive("");
|
|
foo_primitive("");
|
|
%OptimizeMaglevOnNextCall(foo_primitive);
|
|
foo_primitive("");
|