545e9dc58e
The dynamic map check builtin loads the feedback vector from the function's frame, therefore it doesn't work if we inline the function. We don't do inlining on TurboProp so this is fine, but it was possible to enable dynamic map checks on TurboFan which does. This change prevents that, and also makes the dynamic map checks flag specific to TurboProp and no longer an implication, which also allos it to be switched on the command line independenly of --turboprop. BUG=chromium:1141502,v8:9684 Change-Id: I365de461a6373335a45a7a154af7d4cf1c13dc2c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494928 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70737}
22 lines
483 B
JavaScript
22 lines
483 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-lazy-feedback-allocation
|
|
// Flags: --turboprop-dynamic-map-checks
|
|
|
|
function bar(a) {
|
|
return a.x;
|
|
}
|
|
|
|
function foo(a) {
|
|
return 1 * bar(a);
|
|
}
|
|
|
|
var obj = {x: 2};
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
foo(obj, obj);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertThrows(() => foo());
|