v8/test/mjsunit/regress/regress-903697.js
Georg Neis 57512786a4 [turbofan] Install code dependencies atomically.
Split the Install methods into PrepareInstall and Install, such that
all heap mutations (besides the actual installation) are done in
PrepareInstall and only the actual installation in Install. This
ensures that the code object in question doesn't get deoptimized while
we're still installing its dependencies.

Bug: chromium:903697
Change-Id: I4da97d89d0707fa3c00c97c092af0d0faa7a4946
Reviewed-on: https://chromium-review.googlesource.com/c/1329162
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57419}
2018-11-12 08:27:51 +00:00

13 lines
354 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc --verify-heap
C = class {};
for (var i = 0; i < 5; ++i) {
gc();
if (i == 2) %OptimizeOsr();
C.prototype.foo = i + 9000000000000000;
}