6564c6dfc4
Generalize the existing work-around in the method `Map::GeneralizeIfCanHaveTransitionableFastElementsKind()` to also go to the most general field representation (in addition to going to the most field type) for objects with transitionable fast elements kinds. That means that we essentially disable field representation tracking for arrays, arguments objects and value wrappers (for which the field type tracking is already disabled). Drive-by-fix: Remove the `constness` parameter to the above mentioned helper method. And fix the printing of the descriptor expectations to properly print the field type. Change-Id: I1bba9415f4bdd2c916f9d105d9120c7071d2c498 Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel Doc: http://bit.ly/v8-in-place-field-representation-changes Bug: v8:8749, v8:8865, v8:9114, chromium:959645, chromium:952682 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1598756 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#61284}
16 lines
376 B
JavaScript
16 lines
376 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --modify-field-representations-inplace
|
|
|
|
function f(array, x) {
|
|
array.x = x;
|
|
array[0] = 1.1;
|
|
return array;
|
|
}
|
|
|
|
f([1], 1);
|
|
f([2], 1);
|
|
%HeapObjectVerify(f([3], undefined));
|