545e9dc58e
The dynamic map check builtin loads the feedback vector from the function's frame, therefore it doesn't work if we inline the function. We don't do inlining on TurboProp so this is fine, but it was possible to enable dynamic map checks on TurboFan which does. This change prevents that, and also makes the dynamic map checks flag specific to TurboProp and no longer an implication, which also allos it to be switched on the command line independenly of --turboprop. BUG=chromium:1141502,v8:9684 Change-Id: I365de461a6373335a45a7a154af7d4cf1c13dc2c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494928 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70737}
37 lines
871 B
JavaScript
37 lines
871 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turboprop --turboprop-dynamic-map-checks --opt
|
|
// Flags: --no-always-opt
|
|
|
|
function load(obj){
|
|
return obj.x;
|
|
}
|
|
|
|
var o = {x:20, y:30};
|
|
var o1 = {x:20, y:30, z:40};
|
|
|
|
%PrepareFunctionForOptimization(load);
|
|
load(o);
|
|
load(o1);
|
|
|
|
%OptimizeFunctionOnNextCall(load);
|
|
load(o);
|
|
load(o1);
|
|
assertOptimized(load);
|
|
|
|
// deprecate maps in IC
|
|
o.x = 21.32;
|
|
o1.x = 21.32;
|
|
|
|
// transition poly -> mono
|
|
var o2 = {y:20, x:20};
|
|
// This bails out to interpreter and updates the IC state
|
|
load(o2);
|
|
// Optimized code sees monomorphic and should deopt.
|
|
load(o2);
|
|
// should deptimize since we wouldn't generate checks for monomorphic when
|
|
// starting off with polymorphic
|
|
assertUnoptimized(load);
|