450128c79e
While we only need to check stability of the receiver map if its inference was "unreliable", we must check stability of each prototype's map unconditionally. Bug: chromium:997100 Change-Id: I20071ac9eb74c810ad2ab1d78abfb54a1a006c29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768576 Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#63364}
16 lines
441 B
JavaScript
16 lines
441 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function C() { return this };
|
|
function foo() {
|
|
return new C() instanceof function(){};
|
|
}
|
|
%PrepareFunctionForOptimization(C);
|
|
%PrepareFunctionForOptimization(foo);
|
|
assertFalse(foo());
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertFalse(foo());
|