Ben Murdoch | 4a90d5f | 2016-03-22 12:00:34 +0000 | [diff] [blame] | 1 | // Copyright 2015 the V8 project authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | // Flags: --allow-natives-syntax --expose-gc |
| 6 | |
| 7 | var inner = new Array(); |
| 8 | inner.a = {x:1}; |
| 9 | inner[0] = 1.5; |
| 10 | inner.b = {x:2}; |
| 11 | assertTrue(%HasFastDoubleElements(inner)); |
| 12 | |
| 13 | function foo(o) { |
| 14 | return o.field.a.x; |
| 15 | } |
| 16 | |
| 17 | var outer = {}; |
| 18 | outer.field = inner; |
| 19 | foo(outer); |
| 20 | foo(outer); |
| 21 | foo(outer); |
| 22 | %OptimizeFunctionOnNextCall(foo); |
| 23 | foo(outer); |
| 24 | |
| 25 | // Generalize representation of field "a" of inner object. |
| 26 | var v = { get x() { return 0x7fffffff; } }; |
| 27 | inner.a = v; |
| 28 | |
| 29 | gc(); |
| 30 | |
| 31 | var boom = foo(outer); |
| 32 | print(boom); |
| 33 | assertEquals(0x7fffffff, boom); |