ae8823217d
Instead of using addresses of prototype and constructor (which can be movedby GC) when computing the hash of a Map, we use the addresses of the prototype map (which won't be compacted). The prototype map is in a 1:1 relation with the prototype. In addition the prototype points to the constructor in most cases. Bug: v8:11519 Change-Id: Ibc47e5870955d7721509be07fae7719a93da9a26 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739646 Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#73286}
26 lines
663 B
JavaScript
26 lines
663 B
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --gc-interval=500 --stress-compaction
|
|
|
|
function bar(a) {
|
|
return Object.defineProperty(a, 'x', {get() { return 1; }});
|
|
}
|
|
|
|
function foo() {
|
|
return {};
|
|
}
|
|
|
|
%NeverOptimizeFunction(bar);
|
|
%PrepareFunctionForOptimization(foo);
|
|
const o = foo(); // Keep a reference so the GC doesn't kill the map.
|
|
%SimulateNewspaceFull();
|
|
bar(o);
|
|
const a = bar(foo());
|
|
%SimulateNewspaceFull();
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
const b = bar(foo());
|
|
|
|
assertTrue(%HaveSameMap(a, b));
|