v8/test/mjsunit/regress/regress-crbug-1161847-2.js
Frank Emrich c9b4f3c4a7 [dict-proto] TF support for constants in dictionary mode protos, pt. 4
This CL is part of a  series that implements Turbofan support for
property accesses satisfying the following conditions:
1. The holder is a dictionary mode object.
2. The holder is a prototype.
3. The access is a load.

This feature will only be enabled if the build flag
v8_dict_property_const_tracking is set.

This particular CL modifies existing mjsunit tests whose assumptions
don't hold if v8_dict_property_const_tracking is enabled. This is
done by adding special handling for the case that
%IsDictPropertyConstTrackingEnabled() holds.

Bug: v8:11248
Change-Id: Ia36be73e4659a988b2471f0c8151b0442f3a98f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2780292
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73745}
2021-03-31 14:53:45 +00:00

30 lines
1009 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(first_run) {
let o = { x: 0 };
if (first_run) assertTrue(%HasOwnConstDataProperty(o, 'x'));
Object.defineProperty(o, 'x', { get() { return 1; }, configurable: true, enumerable: true });
delete o.x;
o.x = 23;
if (%IsDictPropertyConstTrackingEnabled()) {
// TODO(11248, ishell) Adding a property always sets it to constant if
// V8_DICT_PROPERTY_CONST_TRACKING is enabled, even if the property was
// deleted before and is re-added. See
// LookupIterator::PrepareTransitionToDataProperty, specically the usage of
// PropertyDetails::kConstIfDictConstnessTracking in there.
return;
}
if (first_run) assertFalse(%HasOwnConstDataProperty(o, 'x'));
}
%PrepareFunctionForOptimization(foo);
foo(true);
foo(false);
%OptimizeFunctionOnNextCall(foo);
foo(false);