9da5e9ab5b
This reverts commit 9d0154d6ed.
Reason for revert: gc stress breakage, prob this commit is broken.
Original change's description:
> [heap] Verify FeedbackVector contents during heap verification.
>
> Pre-work for in-place weak refs.
>
> BUG=v8:7308
>
> Change-Id: I5c7086bded14879f62ab366d0aba59302f0078d3
> Reviewed-on: https://chromium-review.googlesource.com/1010069
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52681}
TBR=marja@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,ishell@chromium.org
Change-Id: I7d95e375e06db186f0e9823cb080ce15d1e1062d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Reviewed-on: https://chromium-review.googlesource.com/1019180
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52682}
32 lines
602 B
JavaScript
32 lines
602 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc
|
|
|
|
const f = eval(`(function f(i) {
|
|
if (i == 0) {
|
|
class Derived extends Object {
|
|
constructor() {
|
|
super();
|
|
${"this.a=1;".repeat(0x3fffe-8)}
|
|
}
|
|
}
|
|
return Derived;
|
|
}
|
|
|
|
class DerivedN extends f(i-1) {
|
|
constructor() {
|
|
super();
|
|
${"this.a=1;".repeat(0x40000-8)}
|
|
}
|
|
}
|
|
|
|
return DerivedN;
|
|
})`);
|
|
|
|
let a = new (f(0x7ff))();
|
|
a.a = 1;
|
|
gc();
|
|
assertEquals(1, a.a);
|