130f919217
The tests need to properly hold on to the original fast-mode map, otherwise the GC might clear that, and so the NormalizedMapCache lookup would fail due to that. Bug: chromium:963411, v8:9114, v8:9183, v8:9267 Change-Id: Ic41ed363959a5c182c74097767dc14c366076e17 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627333 Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#61772}
24 lines
581 B
JavaScript
24 lines
581 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function bar(a) {
|
|
return Object.defineProperty(a, 'x', {get() { return 1; }});
|
|
}
|
|
|
|
function foo() {
|
|
return Array(1);
|
|
}
|
|
|
|
%NeverOptimizeFunction(bar);
|
|
%PrepareFunctionForOptimization(foo);
|
|
const o = foo(); // Keep a reference so the GC doesn't kill the map.
|
|
bar(o);
|
|
const a = bar(foo());
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
const b = bar(foo());
|
|
|
|
assertTrue(%HaveSameMap(a, b));
|