6ee0b6cec6
This adds support for deoptimizing into the JSConstructStub after the
receiver instantiation but before the actual constructor invocation.
Such a deoptimization point is needed for cases where instantiation
might be observed (e.g. when new.target is a proxy) and hence might
trigger a deopt.
We use this new deoptimization point for the "after" frame-state the
inliner attaches to {JSCreate} nodes being inserted when constructor
calls are being inlined.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-5638b
BUG=v8:5638
Change-Id: I7c72c807ee8fb76d12e0e9ccab86d970ab1a0efd
Reviewed-on: https://chromium-review.googlesource.com/440125
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43149}
45 lines
993 B
JavaScript
45 lines
993 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
class A {
|
|
constructor(arg) {
|
|
assertEquals(123, arg);
|
|
assertSame(observer, new.target);
|
|
superclass_counter++;
|
|
}
|
|
}
|
|
|
|
class B extends A {
|
|
constructor() {
|
|
super(123);
|
|
construction_counter++;
|
|
}
|
|
}
|
|
|
|
var superclass_counter = 0;
|
|
|
|
var construction_counter = 0;
|
|
|
|
var observation_counter = 0;
|
|
|
|
var observer = new Proxy(A, {
|
|
get(target, property, receiver) {
|
|
if (property === 'prototype') {
|
|
%DeoptimizeFunction(B);
|
|
observation_counter++;
|
|
}
|
|
return Reflect.get(target, property, receiver);
|
|
}
|
|
});
|
|
|
|
Reflect.construct(B, [], observer);
|
|
Reflect.construct(B, [], observer);
|
|
%OptimizeFunctionOnNextCall(B);
|
|
Reflect.construct(B, [], observer);
|
|
assertEquals(3, observation_counter);
|
|
assertEquals(3, construction_counter);
|
|
assertEquals(3, superclass_counter);
|