mirror of
https://github.com/nodejs/node.git
synced 2025-05-19 08:07:23 +00:00
f9ce97084c
V8 3.26.31 has received 14 patches since the upgrade to 3.26.33. Since 3.26.33 is technically a tag on the 3.27 branch, reverting back to 3.26.31 would remove now default functionality like WeakMaps. Because of that the patches have simply been cherry-picked and squashed. Here is a summary of all patches: * Fix index register assignment in LoadFieldByIndex for arm, arm64, and mips. * Fix invalid attributes when generalizing because of incompatible map change. * Skip write barriers when updating the weak hash table. * MIPS: Avoid HeapObject check in HStoreNamedField. * Do GC if CodeRange fails to allocate a block. * Array.concat: properly go to dictionary mode when required. * Keep CodeRange::current_allocation_block_index_ in range. * Grow heap slower if GC freed many global handles. * Do not eliminate bounds checks for "<const> - x". * Add missing map check to optimized f.apply(...). * In GrowMode, force the value to the right representation to avoid deopts between storing the length and storing the value. * Reduce max executable size limit. * Fix invalid condition in check elimination effects. * Fix off-by-one error in Array.concat slow mode check. For more information see: https://github.com/v8/v8/commits/3.26 Reviewed-By: Fedor Indutny <fedor@indutny.com>
28 lines
493 B
JavaScript
28 lines
493 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --track-field-types --use-gvn
|
|
|
|
function A(id) {
|
|
this.id = id;
|
|
}
|
|
|
|
var a1 = new A(1);
|
|
var a2 = new A(2);
|
|
|
|
|
|
var g;
|
|
function f(o, value) {
|
|
g = o.o;
|
|
o.o = value;
|
|
return o.o;
|
|
}
|
|
|
|
var obj = {o: a1};
|
|
|
|
f(obj, a1);
|
|
f(obj, a1);
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertEquals(a2.id, f(obj, a2).id);
|