545e9dc58e
The dynamic map check builtin loads the feedback vector from the function's frame, therefore it doesn't work if we inline the function. We don't do inlining on TurboProp so this is fine, but it was possible to enable dynamic map checks on TurboFan which does. This change prevents that, and also makes the dynamic map checks flag specific to TurboProp and no longer an implication, which also allos it to be switched on the command line independenly of --turboprop. BUG=chromium:1141502,v8:9684 Change-Id: I365de461a6373335a45a7a154af7d4cf1c13dc2c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494928 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70737}
33 lines
706 B
JavaScript
33 lines
706 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turboprop --turboprop-dynamic-map-checks --opt
|
|
// Flags: --no-always-opt
|
|
|
|
function load(obj){
|
|
return obj.x;
|
|
}
|
|
|
|
var o = {x: 10, y:20};
|
|
var o1 = {x:10, y:20, z:30};
|
|
|
|
%PrepareFunctionForOptimization(load);
|
|
// polymorphic with same handler
|
|
load(o);
|
|
load(o1);
|
|
|
|
%OptimizeFunctionOnNextCall(load);
|
|
load(o);
|
|
load(o1);
|
|
assertOptimized(load);
|
|
|
|
var o2 = {y: 10, x:20};
|
|
// deopts but stays optimized
|
|
load(o2);
|
|
assertOptimized(load);
|
|
|
|
// deopts and discard code on wrong handler
|
|
load(o2);
|
|
assertUnoptimized(load);
|