58164026fe
An earlier cl: https://chromium-review.googlesource.com/c/v8/v8/+/2354810 fixed loading double fields with dynamic map checks. The fix however didn't update the expected type information to also expect Smi fields. So, in the later optimization phases the CheckHeapObject operation was reduced to a NoP since the expected type was a HeapObject. This cl fixes the bug by updating the type to Type::Any. Bug: chromium:1124696, v8:10582 Change-Id: Ic96dd74c97caf8eaf5289d8e8939f6feb1686a57 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396088 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#69730}
33 lines
763 B
JavaScript
33 lines
763 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --dynamic-map-checks --allow-natives-syntax --opt --no-always-opt
|
|
|
|
function f(v) {
|
|
return v.b;
|
|
}
|
|
var v = { a: 10, b: 10.23 };
|
|
%PrepareFunctionForOptimization(f);
|
|
f(v);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(v);
|
|
assertOptimized(f);
|
|
v.b = {x: 20};
|
|
assertEquals(f(v).x, 20);
|
|
// Must deoptimize because of field-rep changes for field 'b'
|
|
assertUnoptimized(f);
|
|
|
|
function f0(v) {
|
|
return v.b;
|
|
}
|
|
var v0 = { b: 10.23 };
|
|
%PrepareFunctionForOptimization(f0);
|
|
f0(v0);
|
|
// Transition the field to an Smi field.
|
|
v0.b = {};
|
|
v0.b = 0;
|
|
%OptimizeFunctionOnNextCall(f0);
|
|
f0(v0);
|
|
assertEquals(f0(v0), 0);
|