d871c5ba80
When a virtual object passes by a store node that updates a field to the existing value, then the object and its state were not copied, which lead to the original object being passed on. If then later the store actually modifies and copies the virtual object, this new copy is not passed down the effect chain, so subsequent nodes still refer to the original virtual object and try to update it once new information flows in. This conflicts with updates on the node that originally created the virtual object, leading to divergence. Bug: v8:6345 Change-Id: Iab1ce98a60b48478b343eae765c80bdfcb8ba390 Reviewed-on: https://chromium-review.googlesource.com/496267 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#45120}
19 lines
396 B
JavaScript
19 lines
396 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --no-turbo-loop-peeling --turbo-escape
|
|
|
|
function foo(){
|
|
var o = {a : 5}
|
|
for (var i = 0; i < 100; ++i) {
|
|
o.a = 5;
|
|
o.a = 7;
|
|
}
|
|
}
|
|
|
|
foo();
|
|
foo();
|
|
%OptimizeFunctionOnNextCall(foo)
|
|
foo();
|