4c35194d91
- We didn't take stability dependencies on the inferred maps in case of kUnreliableReceiverMaps. - We didn't take stability dependencies on the prototype chains. Bug: v8:9041 Change-Id: I85418dbed219f51e7fb46c59a0cb9cbb9b499bc1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1541107 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#60550}
22 lines
536 B
JavaScript
22 lines
536 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function() {
|
|
class A {}
|
|
|
|
function foo(a, fn) {
|
|
const C = a.constructor;
|
|
fn(a);
|
|
return a instanceof C;
|
|
}
|
|
|
|
assertTrue(foo(new A, (a) => {}));
|
|
assertTrue(foo(new A, (a) => {}));
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertTrue(foo(new A, (a) => {}));
|
|
assertFalse(foo(new A, (a) => { a.__proto__ = {}; }));
|
|
})();
|