v8/test/mjsunit/regress/regress-crbug-608278.js
ishell e17a283f92 [es6] Properly handle the case when an inlined getter/setter/constructor does a tail call.
Deoptimizer is now able to reconstruct topmost accessor and constructor frames.

BUG=chromium:608278, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1936043002
Cr-Commit-Position: refs/heads/master@{#36075}
2016-05-06 12:37:13 +00:00

63 lines
905 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --harmony-tailcalls --allow-natives-syntax
"use strict";
function h() {
var stack = (new Error("boom")).stack;
print(stack);
%DeoptimizeFunction(f1);
%DeoptimizeFunction(f2);
%DeoptimizeFunction(f3);
%DeoptimizeFunction(g);
%DeoptimizeFunction(h);
return 1;
}
%NeverOptimizeFunction(h);
function g(v) {
return h();
}
%SetForceInlineFlag(g);
function f1() {
var o = {};
o.__defineGetter__('p', g);
o.p;
}
f1();
f1();
%OptimizeFunctionOnNextCall(f1);
f1();
function f2() {
var o = {};
o.__defineSetter__('q', g);
o.q = 1;
}
f2();
f2();
%OptimizeFunctionOnNextCall(f2);
f2();
function A() {
return h();
}
function f3() {
new A();
}
f3();
f3();
%OptimizeFunctionOnNextCall(f3);
f3();