1 // Copyright 2015 the V8 project authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 // Flags: --allow-natives-syntax --expose-gc 6 7 var inner = new Array(); 8 inner.a = {x:1}; 9 inner[0] = 1.5; 10 inner.b = {x:2}; 11 assertTrue(%HasFastDoubleElements(inner)); 12 13 function foo(o) { 14 return o.field.b.x; 15 } 16 17 var outer = {}; 18 outer.field = inner; 19 foo(outer); 20 foo(outer); 21 foo(outer); 22 %OptimizeFunctionOnNextCall(foo); 23 foo(outer); 24 25 // Generalize representation of field "b" of inner object. 26 var v = { get x() { return 0x7fffffff; } }; 27 inner.b = v; 28 29 gc(); 30 31 var boom = foo(outer); 32 print(boom); 33 assertEquals(0x7fffffff, boom); 34
