9eb92da618
Since the deoptimizer generalizes maps for all materialized objects, it must make sure that none of the object's fields contain mutable heap numbers (only double fields are allowed to point to mutable heap numbers). With this CL, we simply change any mutable heap numbers in property arrays to immutable ones. This could be dangerous if some non-materialized object could point to this property array, but this cannot happen because interpreter registers cannot refer to naked property arrays. Bug: chromium:776309 Change-Id: I897b604fa804de673710cfa3ba0595dbd9f80eeb Reviewed-on: https://chromium-review.googlesource.com/759781 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#49263}
28 lines
603 B
JavaScript
28 lines
603 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function C() { }
|
|
|
|
function f(b) {
|
|
var o = new C();
|
|
// Create out-of-object properties only on one branch so that escape
|
|
// analysis does not analyze the property array away.
|
|
if (b) o.t = 1.1;
|
|
%_DeoptimizeNow();
|
|
return o.t;
|
|
}
|
|
|
|
// Finish slack tracking for C.
|
|
for (var i = 0; i < 1000; i++) new C();
|
|
|
|
f(true);
|
|
f(true);
|
|
f(false);
|
|
|
|
%OptimizeFunctionOnNextCall(f);
|
|
|
|
assertEquals(1.1, f(true));
|