3551cac6da
With in-place representation changes we can transition from a double field to a Tagged field without changing the map. So it is not always safe to assume the loaded value would be a HeapNumber. TurboFan takes a dependency on the field representation to ensure the code is deoptimized on any changes. With dynamic map checks, it is not possible to take such a dependency. Hence check the loaded value is a HeapNumber and deoptimize otherwise. Bug: chromium:1112155,v8:10582 Change-Id: I910ac1c0781ac8842fdbf272f9173b55b02923ba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2354810 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#69521}
20 lines
533 B
JavaScript
20 lines
533 B
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
//
|
|
// Flags: --dynamic-map-checks --allow-natives-syntax --opt --no-always-opt
|
|
|
|
function f(v) {
|
|
return v.b;
|
|
}
|
|
var v = { a: 10, b: 10.23 };
|
|
%PrepareFunctionForOptimization(f);
|
|
f(v);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(v);
|
|
assertOptimized(f);
|
|
v.b = {x: 20};
|
|
assertEquals(f(v).x, 20);
|
|
// Must deoptimize because of field-rep changes for field 'b'
|
|
assertUnoptimized(f);
|