v8/test/mjsunit/ic-megadom-3.js
Maya Lekova 5480e036d2 [megadom] Add TF inlining for Megadom
The generated code checks if the receiver is a JS_API_OBJECT and if the
receiver requires an access check, and if not it lowers the call to an
API call.

We also add compilation dependencies on the protector cell to deopt if
our invariants change. (Note - the actual invalidation of these cells
will be implemented in a follow up CL)

Bug: v8:11321
Change-Id: I15722f1e5fac7176e292da4a35186e4609636aba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2719563
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80748}
2022-05-25 14:07:01 +00:00

58 lines
1.1 KiB
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --enable-mega-dom-ic --allow-natives-syntax
// This tests checks that load property access using megadom IC
// handles correctly the error of signature mismatch.
function load(obj) {
return obj.nodeType;
}
%PrepareFunctionForOptimization(load);
let a = new d8.dom.Div();
let b = new d8.dom.Div();
b.b = 1;
let c = new d8.dom.Div();
c.c = 1;
let d = new d8.dom.Div();
d.d = 1;
let e = new d8.dom.Div();
e.e = 1;
let f = new d8.dom.Div();
f.f = 1;
const objs = [
a, b, c, d, e, f
];
function test() {
let result = 0;
for (let i = 0; i < objs.length; i++) {
result += load(objs[i]);
}
try {
load(new d8.dom.EventTarget());
} catch (err) {
assertInstanceof(err, TypeError);
assertEquals("Illegal invocation", err.message, 'Error message');
}
return result;
}
%PrepareFunctionForOptimization(test);
let result = test();
assertEquals(6, result);
%OptimizeFunctionOnNextCall(test);
result = test();
assertEquals(6, result);