37 lines
884 B
JavaScript
37 lines
884 B
JavaScript
|
// Copyright 2024 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
// Flags: --allow-natives-syntax
|
||
|
|
|
||
|
|
var p1 = {}
|
||
|
|
var p2 = {}
|
||
|
|
function foo() {}
|
||
|
|
var o1 = new foo();
|
||
|
|
|
||
|
|
// Pre-seed 3 maps where con is constant
|
||
|
|
o1.con = 1;
|
||
|
|
o1.__proto__ = p1;
|
||
|
|
o1.__proto__ = p2;
|
||
|
|
|
||
|
|
// The o.con store only clears constness of the middle map. Both
|
||
|
|
// proto transitions above and below do not propagate the constness
|
||
|
|
// change. Thus both loads at the bottom and top seem to be reading
|
||
|
|
// from the same constant field.
|
||
|
|
function t1(o) {
|
||
|
|
var a = o.con;
|
||
|
|
o.__proto__ = p1;
|
||
|
|
o.con = 2;
|
||
|
|
o.__proto__ = p2;
|
||
|
|
return a + o.con;
|
||
|
|
}
|
||
|
|
function t2() {
|
||
|
|
var o = new foo();
|
||
|
|
o.con = 1;
|
||
|
|
return t1(o);
|
||
|
|
}
|
||
|
|
%PrepareFunctionForOptimization(t1);
|
||
|
|
assertTrue(t2() == 3);
|
||
|
|
%OptimizeFunctionOnNextCall(t1);
|
||
|
|
assertTrue(t2() == 3);
|