6e27386d68
This is a reland of b90e83f5da
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}
Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}
26 lines
532 B
JavaScript
26 lines
532 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --verify-heap --allow-natives-syntax --expose-gc
|
|
|
|
let constant = { a: 1 };
|
|
|
|
function update_array(array) {
|
|
array.x = constant;
|
|
%HeapObjectVerify(array);
|
|
array[0] = undefined;
|
|
%HeapObjectVerify(array);
|
|
return array;
|
|
}
|
|
|
|
let ar1 = [1];
|
|
let ar2 = [2];
|
|
let ar3 = [3];
|
|
gc();
|
|
gc();
|
|
|
|
update_array(ar1);
|
|
constant = update_array(ar2);
|
|
update_array(ar3);
|