v8/test/mjsunit/regress/regress-781218.js
Camillo Bruni 837ce0f9a3 [test] Adjust empty PropertyArray regression test
Make sure we have at least two elements in the Map, otherwise we don't
perform a proper dictionary lookup.

Bug: chromium:781218
Change-Id: I471e3822b95c15e3a5b2ac54c8ad1f030bd54d40
Reviewed-on: https://chromium-review.googlesource.com/768708
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49345}
2017-11-14 09:14:18 +00:00

54 lines
1.1 KiB
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var m = new Map();
function C() { }
// Make sure slack tracking kicks in and shrinks the default size to prevent
// any further in-object properties.
%CompleteInobjectSlackTracking(new C());
function f(o) {
o.x = true;
}
// Warm up {f}.
f(new C());
f(new C());
var o = new C();
%HeapObjectVerify(o);
// We need at least 2 elements in the Map.
m.set({}, 3);
// This creates hash code on o.
m.set(o, 1);
// Add an out-of-object property.
o.x = true;
%HeapObjectVerify(o);
// Delete the property (so we have no out-of-object properties).
delete o.x;
%HeapObjectVerify(o);
// Ensure that growing the properties backing store in optimized code preserves
// the hash.
%OptimizeFunctionOnNextCall(f);
f(o);
%HeapObjectVerify(o);
assertEquals(1, m.get(o));
// Grow the Map and ensure the object is still found.
for (let i = 0; i < 1000; i++) {
let object = {};
m.set(object, object);
assertEquals(1, m.get(o));
}