545e9dc58e
The dynamic map check builtin loads the feedback vector from the function's frame, therefore it doesn't work if we inline the function. We don't do inlining on TurboProp so this is fine, but it was possible to enable dynamic map checks on TurboFan which does. This change prevents that, and also makes the dynamic map checks flag specific to TurboProp and no longer an implication, which also allos it to be switched on the command line independenly of --turboprop. BUG=chromium:1141502,v8:9684 Change-Id: I365de461a6373335a45a7a154af7d4cf1c13dc2c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494928 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70737}
37 lines
763 B
JavaScript
37 lines
763 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turboprop --turboprop-dynamic-map-checks --opt
|
|
// Flags: --no-always-opt
|
|
|
|
function f(o) {
|
|
return o.b;
|
|
}
|
|
|
|
var o = {a:10, b:20};
|
|
var o1 = {a:10, b:20};
|
|
var o2 = {a:10, b:20};
|
|
%PrepareFunctionForOptimization(f);
|
|
f(o);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(o);
|
|
assertOptimized(f);
|
|
|
|
// Deprecates o's map.
|
|
o1.b = 10.23;
|
|
|
|
// Bails out but retains code.
|
|
f(o1);
|
|
assertOptimized(f);
|
|
|
|
// Passing in original object should not cause any deopts.
|
|
f(o);
|
|
f(o);
|
|
assertOptimized(f);
|
|
|
|
// o and o2 have the same Map, so there should be no deopts.
|
|
f(o2);
|
|
f(o2);
|
|
assertOptimized(f);
|