b17dee636f
This adds missing support for in-object properties within objects having
the {JSGeneratorObject} type to materialization during deoptimization.
For corner-cases where the implicit generator object is statically known
not to escape, object layout might still be arbitrarily complex.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-732169
BUG=chromium:732169,v8:6481
Change-Id: I32f373913d60af64981dc4ed66873cc8a1dbe872
Reviewed-on: https://chromium-review.googlesource.com/530230
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45870}
30 lines
949 B
JavaScript
30 lines
949 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function TestGeneratorMaterialization() {
|
|
function* f([x]) { yield x }
|
|
// No warm-up of {f} to trigger soft deopt.
|
|
%OptimizeFunctionOnNextCall(f);
|
|
var gen = f([23]);
|
|
assertEquals("[object Generator]", gen.toString());
|
|
assertEquals({ done:false, value:23 }, gen.next());
|
|
assertEquals({ done:true, value:undefined }, gen.next());
|
|
})();
|
|
|
|
(function TestGeneratorMaterializationWithProperties() {
|
|
function* f(x = (%_DeoptimizeNow(), 23)) { yield x }
|
|
function g() {
|
|
var gen = f();
|
|
gen.p = 42;
|
|
return gen;
|
|
}
|
|
function h() { f() }
|
|
// Enough warm-up to make {p} an in-object property.
|
|
for (var i = 0; i < 100; ++i) { g(); h(); }
|
|
%OptimizeFunctionOnNextCall(h);
|
|
h(); // In {h} the generator does not escape.
|
|
})();
|