0c10dda4bd
Previously, when the Load IC saw a deprecated map, it would migrate to the new map but not update the feedback vector. This would lead to a deopt the next time the same object was seen. With this CL, the feedback vector will be updated to the target of the deprecated map. In order to do this, we need to mark the IC for recomputation. Without that call, the map and handler would look the same to IC::UpdatePolymorphicIC amd would decline to update, causing the IC to go megamorphic instead. Bug: v8:10816 Change-Id: I0dcf97fb278bc0b167df6ce24d5db179f599f535 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3032983 Reviewed-by: Mythri Alle <mythria@chromium.org> Commit-Queue: Kevin Babbitt <kbabbitt@microsoft.com> Cr-Commit-Position: refs/heads/master@{#76042}
24 lines
665 B
JavaScript
24 lines
665 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt
|
|
|
|
// https://bugs.chromium.org/p/v8/issues/detail?id=10816
|
|
// When V8 sees a deprecated map, update the IC with its target.
|
|
|
|
function A() { this.x = 1 }
|
|
function B() { this.x = 1 }
|
|
function load(o) { return o.x }
|
|
%PrepareFunctionForOptimization(load);
|
|
|
|
const oldB = new B();
|
|
(new B()).x = 1.5; // deprecates map
|
|
|
|
// Should add the target of the deprecated map to the load IC.
|
|
load(oldB);
|
|
|
|
%OptimizeFunctionOnNextCall(load);
|
|
load(oldB);
|
|
assertOptimized(load);
|