1531fec7e6
Even if we have a constant load, if the map is not stable, we cannot guarantee that the load is preserved across side-effecting calls. Fixed: chromium:1403324 Bug: v8:7700 Change-Id: Ib900cf7574711115439e6521ed8cfaa866525e78 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4123532 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#85014}
30 lines
662 B
JavaScript
30 lines
662 B
JavaScript
// Copyright 2022 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --maglev
|
|
|
|
function foo(__v_4) {
|
|
var __v_5 = function () {
|
|
return __v_4;
|
|
}();
|
|
var __v_6 = __v_5.x;
|
|
arguments[42];
|
|
return __v_6 + __v_5.x;
|
|
}
|
|
var __v_0 = {x: 24};
|
|
__v_0.g = 43;
|
|
|
|
%PrepareFunctionForOptimization(foo);
|
|
foo({x: 42});
|
|
foo({x: 42});
|
|
|
|
%OptimizeMaglevOnNextCall(foo);
|
|
var __v_3 = {x: 42};
|
|
Object.prototype.__defineGetter__(42, function () {
|
|
__v_3.__defineGetter__("x", function () {
|
|
});
|
|
});
|
|
|
|
assertEquals(NaN, foo(__v_3));
|