v8/test/mjsunit/regress/regress-ensure-initial-map.js
verwaest 9bee67509c Don't EnsureHasInitialMap on non-constructors.
non-constructors are not allowed to have initial maps. The optimizing compilers used to add initial maps unconditionally to functions used as right-hand-side in instanceof.

BUG=

Review URL: https://codereview.chromium.org/1490003003

Cr-Commit-Position: refs/heads/master@{#32497}
2015-12-02 10:39:46 +00:00

23 lines
459 B
JavaScript

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
function f(o, b) {
if (b) {
return o instanceof x;
}
}
%OptimizeFunctionOnNextCall(f);
f();
function g() {
return new x();
}
%OptimizeFunctionOnNextCall(g);
assertThrows(()=>g());