deps/v8/test/mjsunit/compiler/test-dynamic-map-checks-wrong-handler.js


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax --turboprop --turbo-dynamic-map-checks --opt
// Flags: --no-always-opt

function load(obj){
  return obj.x;
}

%PrepareFunctionForOptimization(load);
obj = {};
obj.x = 1;

//get mono feedback
load(obj);

// optimize as mono
%OptimizeFunctionOnNextCall(load);
load(obj);
assertOptimized(load);
load(obj);

// change the object's representation.
obj.x = 2.3;
load(obj);
// deoptimizes on a wrong map but retains the code
assertOptimized(load);

// deoptimizes on the wrong handler.
load(obj);
assertUnoptimized(load);