9e4c05a8bb
Fixes an issue with tests mjsunit/compiler/call-with-arraylike-or-spread* that fail when run with the fuzzer. Bug: v8:11821 Change-Id: I6b75c065397d66062a7f552198ca92d151d89a4b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917814 Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/master@{#74764}
53 lines
1.7 KiB
JavaScript
53 lines
1.7 KiB
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --turbo-optimize-apply --opt
|
|
|
|
// These tests do not work well if this script is run more than once (e.g.
|
|
// --stress-opt); after a few runs the whole function is immediately compiled
|
|
// and assertions would fail. We prevent re-runs.
|
|
// Flags: --nostress-opt --no-always-opt
|
|
|
|
// The test relies on optimizing/deoptimizing at predictable moments, so
|
|
// it's not suitable for deoptimization fuzzing.
|
|
// Flags: --deopt-every-n-times=0
|
|
|
|
// Tests for optimization of CallWithSpread and CallWithArrayLike.
|
|
// This test is in a separate file because it invalidates protectors.
|
|
|
|
// Test with array prototype modified after compilation.
|
|
(function () {
|
|
"use strict";
|
|
|
|
var sum_js3_got_interpreted = true;
|
|
function sum_js3(a, b, c) {
|
|
sum_js3_got_interpreted = %IsBeingInterpreted();
|
|
return a + b + c;
|
|
}
|
|
function foo(x, y) {
|
|
return sum_js3.apply(null, [x, , y]);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(sum_js3);
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertEquals('AundefinedB', foo('A', 'B'));
|
|
assertTrue(sum_js3_got_interpreted);
|
|
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals('AundefinedB', foo('A', 'B'));
|
|
assertFalse(sum_js3_got_interpreted);
|
|
assertOptimized(foo);
|
|
|
|
// Modify the array prototype, define a default value for element [1].
|
|
Array.prototype[1] = 'x';
|
|
assertUnoptimized(foo);
|
|
|
|
// Now the call will not be inlined.
|
|
%PrepareFunctionForOptimization(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals('AxB', foo('A', 'B'));
|
|
assertTrue(sum_js3_got_interpreted);
|
|
assertOptimized(foo);
|
|
})();
|