f0e054c2c6
When using the fast-properties optimization for `delete` with constant fields we don't properly invalidate the constness on the original map and might thereby just follow the same transition again later with the same object, effectively violating the constness of that field. This disables the fast-properties optimization for `delete` in case of a field marked as "const" as a quick-fix. We might still want to change the logic to properly invalidate the "const" bit later. Bug: chromium:962588, v8:9233 Change-Id: I1d0a8649d117731a0cd5ebdb4b6d0b22a900f33d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609796 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#61484}
23 lines
481 B
JavaScript
23 lines
481 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
let o1 = { x: 999 };
|
|
o1.y = 999;
|
|
|
|
// o2 will share map with o1 in its initial state
|
|
var o2 = { x: 1 };
|
|
|
|
function f() { return o2.x; }
|
|
|
|
assertEquals(1, f());
|
|
assertEquals(1, f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals(1, f());
|
|
|
|
delete o2.x;
|
|
o2.x = 2;
|
|
assertEquals(2, f());
|