ea86509424
This adds constant field tracking for arrays. To prevent changing the field in some other elements-kind-branch of transition tree, we only use the const information in the optimizing compiler if the map is not an array map or if the map is stable (since stable maps cannot transition to a different elements-kind-branch without deopt). Some more details: https://docs.google.com/document/d/1r2GAvdi_wudDS6iRUfdPw0gxWMfV-IX1PqKgwW47FyE Bug: chromium:912162, v8:8361 Change-Id: Iea1b2f03ddee16205c2141ac5e813a973dd23cf4 Reviewed-on: https://chromium-review.googlesource.com/c/1454606 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#59409}
24 lines
374 B
JavaScript
24 lines
374 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var a = new Array();
|
|
a.prototype = a;
|
|
|
|
function f() {
|
|
a.length = 0x2000001;
|
|
a.push();
|
|
}
|
|
|
|
({}).__proto__ = a;
|
|
|
|
f()
|
|
f()
|
|
|
|
a.length = 1;
|
|
a.fill(-255);
|
|
|
|
%HeapObjectVerify(a);
|