e31f0a7d25
PR-URL: https://github.com/nodejs/node/pull/28918 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
42 lines
740 B
JavaScript
42 lines
740 B
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --expose-gc
|
|
|
|
var inner = new Array();
|
|
inner.a = {
|
|
x: 1
|
|
};
|
|
inner[0] = 1.5;
|
|
inner.b = {
|
|
x: 2
|
|
};
|
|
assertTrue(%HasDoubleElements(inner));
|
|
|
|
function foo(o) {
|
|
return o.field.a.x;
|
|
};
|
|
%PrepareFunctionForOptimization(foo);
|
|
var outer = {};
|
|
outer.field = inner;
|
|
foo(outer);
|
|
foo(outer);
|
|
foo(outer);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo(outer);
|
|
|
|
// Generalize representation of field "a" of inner object.
|
|
var v = {
|
|
get x() {
|
|
return 0x7fffffff;
|
|
}
|
|
};
|
|
inner.a = v;
|
|
|
|
gc();
|
|
|
|
var boom = foo(outer);
|
|
print(boom);
|
|
assertEquals(0x7fffffff, boom);
|