v8/test/mjsunit/regress/regress-crbug-813427.js
Camillo Bruni da83b61848 [runtime] Fix overzealous check for derived constructor instance size
Bug: chromium:813427
Change-Id: Ie0b096b20f335648e7920c5ebe4ff0fa3b5ab9d5
Reviewed-on: https://chromium-review.googlesource.com/926003
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51393}
2018-02-20 13:28:37 +00:00

50 lines
1.1 KiB
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
// Create {count} property assignments.
function createPropertiesAssignment(count) {
let result = "";
for (let i = 0; i < count; i++) {
result += "this.p"+i+" = undefined;";
}
return result;
}
function testSubclassProtoProperties(count) {
const MyClass = eval(`(class MyClass {
constructor() {
${createPropertiesAssignment(count)}
}
});`);
class BaseClass {};
class SubClass extends BaseClass {
constructor() {
super()
}
};
const boundMyClass = MyClass.bind();
%HeapObjectVerify(boundMyClass);
SubClass.__proto__ = boundMyClass;
var instance = new SubClass();
%HeapObjectVerify(instance);
// Create some more instances to complete in-object slack tracking.
let results = [];
for (let i = 0; i < 4000; i++) {
results.push(new SubClass());
}
var instance = new SubClass();
%HeapObjectVerify(instance);
}
for (let count = 0; count < 10; count++) {
testSubclassProtoProperties(count);
}