0a6c1a778a
Bug: v8:12552 Change-Id: I99e4d8e8aeba5460f11e54cc1b2bcaea98a5276d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400964 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78698}
32 lines
772 B
JavaScript
32 lines
772 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --allow-natives-syntax --opt --noalways-opt
|
|
|
|
class C {};
|
|
const c = new C;
|
|
const getPrototypeOf = Object.getPrototypeOf;
|
|
|
|
function bar(f) {
|
|
return f();
|
|
}
|
|
function foo() {
|
|
return bar(getPrototypeOf.bind(undefined, c));
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
%PrepareFunctionForOptimization(bar);
|
|
bar(function() {});
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
assertOptimized(foo);
|
|
|
|
c.prop = 42;
|
|
// Assert that the call reducer optimized the call to Object.getPrototypeOf
|
|
// by asserting that foo gets deopted when c's previous map becomes
|
|
// unstable.
|
|
foo();
|
|
assertUnoptimized(foo);
|