cad5b29610
We don't need to add stability dependencies on JSObject prototypes when storing to an element, because we do the map check (and thereby guard the elements kind) and we also properly deoptimize on holes if the array protector is not usable. R=verwaest@chromium.org BUG=chromium:616709 Review-Url: https://codereview.chromium.org/2198833002 Cr-Commit-Position: refs/heads/master@{#38355}
22 lines
464 B
JavaScript
22 lines
464 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
// Make the Object prototype have dictionary properties.
|
|
for (var i = 0; i < 2000; i++) {
|
|
Object.prototype['X'+i] = true;
|
|
}
|
|
|
|
function boom(a1) {
|
|
return a1[0];
|
|
}
|
|
|
|
var a = new Array(1);
|
|
a[0] = 0.1;
|
|
boom(a);
|
|
boom(a);
|
|
%OptimizeFunctionOnNextCall(boom);
|
|
boom(a);
|