e752bcc216
This makes sure that static guarantees about object maps are not used
accross operations on the effect chain that might trigger a map change.
Such operations are missing the {Operator::kNoWrite} property.
R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-685506
BUG=chromium:685506
Review-Url: https://codereview.chromium.org/2653273004
Cr-Commit-Position: refs/heads/master@{#42697}
27 lines
598 B
JavaScript
27 lines
598 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --noconcurrent-recompilation
|
|
|
|
var a = {};
|
|
|
|
function init() {
|
|
a = [];
|
|
for (var __v_1 = 0; __v_1 < 10016; __v_1++) {
|
|
a.push({});
|
|
}
|
|
a.map(function() {}) + "";
|
|
}
|
|
init();
|
|
|
|
function foo() {
|
|
a.push((a + "!", 23));
|
|
return a;
|
|
}
|
|
assertEquals(23, foo()[10016]);
|
|
assertEquals(23, foo()[10017]);
|
|
assertEquals(23, foo()[10018]);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertEquals(23, foo()[10019]);
|