56b6b6a8fa
Currently, we call the MapRef::AsElementsKind method on an initial map multiple times (from JSCreateLowering::ReduceJSCreateArray). However, this does not does not play well with the heap copier/broker, which only expectes AsElementsKind to be called on initial maps. This CL makes sure we only call AsElementsKind once (on the initial map). Bug: chromium:890620 Change-Id: If44421d3900abb7629ea8f789a005b8d8ebaf881 Reviewed-on: https://chromium-review.googlesource.com/1253105 Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#56307}
26 lines
388 B
JavaScript
26 lines
388 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var a = 42;
|
|
|
|
function g(n) {
|
|
while (n > 0) {
|
|
a = new Array(n);
|
|
n--;
|
|
}
|
|
}
|
|
|
|
g(1);
|
|
|
|
function f() {
|
|
g();
|
|
}
|
|
|
|
f();
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f();
|
|
assertEquals(1, a.length);
|