c6a16c10dd
With bytecode flushing and lazy feedback allocation, we need to call %PrepareForOptimization before we call %OptimizeFunctionOnNextCall, ideally after declaring the function. Bug: v8:8801, v8:8394, v8:9183 Change-Id: I3fb257282a30f6526a376a3afdedb44786320d34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648255 Commit-Queue: Mathias Bynens <mathias@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62119}
42 lines
740 B
JavaScript
42 lines
740 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --expose-gc
|
|
|
|
var inner = new Array();
|
|
inner.a = {
|
|
x: 1
|
|
};
|
|
inner[0] = 1.5;
|
|
inner.b = {
|
|
x: 2
|
|
};
|
|
assertTrue(%HasDoubleElements(inner));
|
|
|
|
function foo(o) {
|
|
return o.field.b.x;
|
|
};
|
|
%PrepareFunctionForOptimization(foo);
|
|
var outer = {};
|
|
outer.field = inner;
|
|
foo(outer);
|
|
foo(outer);
|
|
foo(outer);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(outer);
|
|
|
|
// Generalize representation of field "b" of inner object.
|
|
var v = {
|
|
get x() {
|
|
return 0x7fffffff;
|
|
}
|
|
};
|
|
inner.b = v;
|
|
|
|
gc();
|
|
|
|
var boom = foo(outer);
|
|
print(boom);
|
|
assertEquals(0x7fffffff, boom);
|