68beef53c3
This fixes a corner-case where arrow functions that require a context allocate none, because there are no additional slots allocated. Note that this didn't happen with true function scopes because they always had at least the receiver slot. The outcome was a context chain that no longer was in sync with the scope chain, hence context slot loads were bogus. This is observable using the DYNAMIC_LOCAL optimization in all compilers. R=rossberg@chromium.org,wingo@igalia.com TEST=mjsunit/harmony/regress/regress-4160 BUG=v8:4160 LOG=N Review URL: https://codereview.chromium.org/1146063006 Cr-Commit-Position: refs/heads/master@{#28788}
30 lines
779 B
JavaScript
30 lines
779 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --harmony-arrow-functions --allow-natives-syntax
|
|
|
|
(function(x) {
|
|
(function(x) {
|
|
var boom = (() => eval(x));
|
|
assertEquals(23, boom());
|
|
assertEquals(23, boom());
|
|
%OptimizeFunctionOnNextCall(boom);
|
|
assertEquals(23, boom());
|
|
assertEquals("23", x);
|
|
})("23");
|
|
assertEquals("42", x);
|
|
})("42");
|
|
|
|
(function(x) {
|
|
(function(x) {
|
|
var boom = (() => (eval("var x = 66"), x));
|
|
assertEquals(66, boom());
|
|
assertEquals(66, boom());
|
|
%OptimizeFunctionOnNextCall(boom);
|
|
assertEquals(66, boom());
|
|
assertEquals("23", x);
|
|
})("23");
|
|
assertEquals("42", x);
|
|
})("42");
|