5caee70b66
An object with a deprecated Map which has already been cached in CloneObjectIC feedback is still a valid Map for fast cloning --- but to be consistent with other ICs, deprecated maps are ignored, and are expected to be transitioned away from. If the source object has a deprecated map, the instance is migrated. BUG=v8:7611, chromium:867958, chromium:868586, chromium:869342, chromium:869347, chromium:869293 R=jkummerow@chromium.org, mvstanton@chromium.org Reviewed-on: https://chromium-review.googlesource.com/1154143 Commit-Queue: Caitlin Potter <caitp@igalia.com> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#54799} Change-Id: I6e2f7b28c41bb9bd6255441da0f209a97bce5e8f Reviewed-on: https://chromium-review.googlesource.com/1157142 Cr-Commit-Position: refs/heads/master@{#54830}
14 lines
505 B
JavaScript
14 lines
505 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Check that encountering deprecated Maps does not cause CloneObjectIC to
|
|
// crash.
|
|
var obj1 = { x: 1 };
|
|
var obj2 = { x: 2 }; // same map
|
|
obj2.x = null; // deprecate map
|
|
|
|
function f() { return { ...obj1 } };
|
|
assertEquals({ x: 1 }, f()); // missed, object migrated to cached new map
|
|
assertEquals({ x: 1 }, f()); // monomorphic cache-hit
|