blob: a71970825d92376ea54cd41f89017e5e438cd1f6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --expose-gc
function P() {
this.a0 = {};
this.a1 = {};
this.a2 = {};
this.a3 = {};
this.a4 = {};
}
function A() {
}
var proto = new P();
A.prototype = proto;
function foo(o) {
return o.a0;
}
// Ensure |proto| is in old space.
gc();
gc();
gc();
// Ensure |proto| is marked as "should be fast".
var o = new A();
%EnsureFeedbackVectorForFunction(foo);
foo(o);
foo(o);
foo(o);
assertEquals(!%IsDictPropertyConstTrackingEnabled(),
%HasFastProperties(proto));
// Contruct a double value that looks like a tagged pointer.
var buffer = new ArrayBuffer(8);
var int32view = new Int32Array(buffer);
var float64view = new Float64Array(buffer);
int32view[0] = int32view[1] = 0x40000001;
var boom = float64view[0];
// Write new space object.
proto.a4 = {a: 0};
// Immediately delete the field.
delete proto.a4;
// |proto| must sill be fast.
assertEquals(!%IsDictPropertyConstTrackingEnabled(),
%HasFastProperties(proto));
// Add a double field instead of deleted a4 that looks like a tagged pointer.
proto.boom = boom;
// Boom!
gc();
|
