c6a16c10dd
With bytecode flushing and lazy feedback allocation, we need to call %PrepareForOptimization before we call %OptimizeFunctionOnNextCall, ideally after declaring the function. Bug: v8:8801, v8:8394, v8:9183 Change-Id: I3fb257282a30f6526a376a3afdedb44786320d34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648255 Commit-Queue: Mathias Bynens <mathias@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62119}
50 lines
1.2 KiB
JavaScript
50 lines
1.2 KiB
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --expose-gc
|
|
|
|
function Inner() {
|
|
this.p1 = 0;
|
|
this.p2 = 3;
|
|
}
|
|
|
|
function Outer() {
|
|
this.p3 = 0;
|
|
}
|
|
|
|
var i1 = new Inner();
|
|
var i2 = new Inner();
|
|
var o1 = new Outer();
|
|
o1.inner = i1;
|
|
// o1.map now thinks "inner" has type Inner.map1.
|
|
// Deprecate Inner.map1:
|
|
i1.p1 = 0.5;
|
|
// Let Inner.map1 die by migrating i2 to Inner.map2:
|
|
print(i2.p1);
|
|
gc();
|
|
// o1.map's descriptor for "inner" is now a cleared weak reference;
|
|
// o1.inner's actual map is Inner.map2.
|
|
// Prepare Inner.map3, deprecating Inner.map2.
|
|
i2.p2 = 0.5;
|
|
// Deprecate o1's map.
|
|
var o2 = new Outer();
|
|
o2.p3 = 0.5;
|
|
o2.inner = i2;
|
|
// o2.map (Outer.map2) now says that o2.inner's type is Inner.map3.
|
|
// Migrate o1 to Outer.map2.
|
|
print(o1.p3);
|
|
// o1.map now thinks that o1.inner has map Inner.map3 just like o2.inner,
|
|
// but in fact o1.inner.map is still Inner.map2!
|
|
|
|
function loader(o) {
|
|
return o.inner.p2;
|
|
};
|
|
%PrepareFunctionForOptimization(loader);
|
|
loader(o2);
|
|
loader(o2);
|
|
%OptimizeFunctionOnNextCall(loader);
|
|
assertEquals(0.5, loader(o2));
|
|
assertEquals(3, loader(o1));
|
|
gc(); // Crashes with --verify-heap.
|