4a7eec590c
This makes sure the builtin lowering of Object.create doesn't invalidate any previously taken dependencies. Aborting compilation after such cases would lead to repeating optimization attempts without learning, hence we disallow such situations. R=verwaest@chromium.org BUG=chromium:794394,chromium:786723 Change-Id: I6b6928cab19692bbbe3cd241ade862a2306eb0c7 Reviewed-on: https://chromium-review.googlesource.com/827066 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#50128}
20 lines
414 B
JavaScript
20 lines
414 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --expose-gc --function-context-specialization
|
|
|
|
function f() {
|
|
var o = {};
|
|
function g() {
|
|
o.x = 1;
|
|
return Object.create(o);
|
|
};
|
|
gc();
|
|
o.x = 10;
|
|
%OptimizeFunctionOnNextCall(g);
|
|
g();
|
|
}
|
|
f();
|
|
f();
|