3a80814d53
With this CL SloppyArguments immediately go to dictionary elements on deletion, keeping the arguments backing store packed. Bug: v8:6251 Change-Id: I90d1972179447bf6810e7fe2b8e0bc8703b38d9d Reviewed-on: https://chromium-review.googlesource.com/486921 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#45286}
23 lines
746 B
JavaScript
23 lines
746 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --expose-gc --allow-natives-syntax
|
|
|
|
function getRandomProperty(v, rand) {
|
|
var properties = Object.getOwnPropertyNames(v);
|
|
if ("constructor" && v.constructor.hasOwnProperty()) {; }
|
|
if (properties.length == 0) { return "0"; }
|
|
return properties[rand % properties.length];
|
|
}
|
|
|
|
var args = (function( b) { return arguments; })("foo", NaN, "bar");
|
|
args.__p_293850326 = "foo";
|
|
%HeapObjectVerify(args);
|
|
args.__defineGetter__(getRandomProperty( 990787501), function() {
|
|
gc();
|
|
return args.__p_293850326;
|
|
});
|
|
%HeapObjectVerify(args);
|
|
Array.prototype.indexOf.call(args)
|