ea55b873f2
IC system does its best to properly mark stable transition source maps as unstable (see https://chromium-review.googlesource.com/483442) however an already recorded map can be deprecated later and the optimizing compiler may try to generate an elements kind transition from the updated version of deprecated map which can "become" stable again. Bug: chromium:723455 Change-Id: Ic0c392f153587c3cd7c7623a3a6ea85ec72ad5bd Reviewed-on: https://chromium-review.googlesource.com/507887 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#45384}
19 lines
372 B
JavaScript
19 lines
372 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --verify-heap
|
|
|
|
function f(a) {
|
|
a.x = 0;
|
|
a[0] = 0.1;
|
|
a.x = {};
|
|
}
|
|
|
|
f(new Array(1));
|
|
f(new Array(1));
|
|
f(new Array());
|
|
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f(new Array(1));
|