c7643fe485
This cl also 1. Fixes a bug in effect-control-linearizer where we should have converted fixed array length from Smi to integer 2. Also prints deopt location for the new "bailout" deopt type on --trace-deopt. Bug: v8:10582, v8:9684 Change-Id: Iafc5e8abbca5252a8783a5a1184a1667a7f708a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297460 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#69115}
34 lines
711 B
JavaScript
34 lines
711 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turboprop --dynamic-map-checks --opt
|
|
// Flags: --no-always-opt
|
|
|
|
function load(obj){
|
|
return obj.x;
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(load);
|
|
obj = {};
|
|
obj.x = 1;
|
|
|
|
//get mono feedback
|
|
load(obj);
|
|
|
|
// optimize as mono
|
|
%OptimizeFunctionOnNextCall(load);
|
|
load(obj);
|
|
assertOptimized(load);
|
|
load(obj);
|
|
|
|
// change the object's representation.
|
|
obj.x = 2.3;
|
|
load(obj);
|
|
// deoptimizes on a wrong map but retains the code
|
|
assertOptimized(load);
|
|
|
|
// deoptimizes on the wrong handler.
|
|
load(obj);
|
|
assertUnoptimized(load);
|