v8/test/mjsunit/compiler/array-species.js
Georg Neis e3d4dd0805 Add missing deopt-trigger to invalidation of some protector cells.
R=bmeurer@chromium.org

Change-Id: Idd9c45f733e2e5d518c69a6ead2b56f6433ca30e
Reviewed-on: https://chromium-review.googlesource.com/1114598
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54020}
2018-06-26 09:38:20 +00:00

34 lines
657 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function Foo() {}
function f() {
return [42].map(_ => 88);
}
let y;
y = f();
assertFalse(y instanceof Foo);
assertInstanceof(y, Array);
y = f();
assertFalse(y instanceof Foo);
assertInstanceof(y, Array);
%OptimizeFunctionOnNextCall(f);
y = f();
assertFalse(y instanceof Foo);
assertInstanceof(y, Array);
assertTrue(Reflect.defineProperty(Array, Symbol.species, {value: Foo}));
y = f();
assertInstanceof(y, Foo);
assertFalse(y instanceof Array);