v8/test/mjsunit/regress/regress-crbug-944865.js
Benedikt Meurer acdeb64c60 [turbofan] Bail out for accesses to fields with representation None.
When TurboFan optimizes field access, we need to check first that the
runtime already determined the correct field representation properly.
If the field representation is still None, we cannot optimize this in
TurboFan straight away but we have to call the IC to let the runtime
do the magic.

Bug: chromium:944865
Change-Id: I032a48824e83806e1be7670346f518b258a9dd65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1549167
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60607}
2019-04-03 15:07:00 +00:00

16 lines
449 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() {
const r = {e: NaN, g: undefined, c: undefined};
const u = {__proto__: {}, e: new Set(), g: 0, c: undefined};
return r;
}
foo();
%OptimizeFunctionOnNextCall(foo);
const o = foo();
Object.defineProperty(o, 'c', {value: 42});