1 // Copyright 2015 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax --expose-gc 6 7 function Inner() { 8 this.p1 = 0; 9 this.p2 = 3; 10 } 11 12 function Outer() { 13 this.p3 = 0; 14 } 15 16 var i1 = new Inner(); 17 var i2 = new Inner(); 18 var o1 = new Outer(); 19 o1.inner = i1; 20 // o1.map now thinks "inner" has type Inner.map1. 21 // Deprecate Inner.map1: 22 i1.p1 = 0.5; 23 // Let Inner.map1 die by migrating i2 to Inner.map2: 24 print(i2.p1); 25 gc(); 26 // o1.map's descriptor for "inner" is now a cleared WeakCell; 27 // o1.inner's actual map is Inner.map2. 28 // Prepare Inner.map3, deprecating Inner.map2. 29 i2.p2 = 0.5; 30 // Deprecate o1's map. 31 var o2 = new Outer(); 32 o2.p3 = 0.5; 33 o2.inner = i2; 34 // o2.map (Outer.map2) now says that o2.inner's type is Inner.map3. 35 // Migrate o1 to Outer.map2. 36 print(o1.p3); 37 // o1.map now thinks that o1.inner has map Inner.map3 just like o2.inner, 38 // but in fact o1.inner.map is still Inner.map2! 39 40 function loader(o) { 41 return o.inner.p2; 42 } 43 loader(o2); 44 loader(o2); 45 %OptimizeFunctionOnNextCall(loader); 46 assertEquals(0.5, loader(o2)); 47 assertEquals(3, loader(o1)); 48 gc(); // Crashes with --verify-heap. 49
