bug1914821.js (805B)
1 var shapes = []; 2 for (var i = 0; i < 8; i++) { 3 shapes.push({x: 1, ["y" + i]: 1}); 4 } 5 6 function foo(o, o2, cond) { 7 var result = 0; 8 for (var i = 0; i < 2; i++) { 9 if (cond) { 10 result += o.x; // hoistable guard 11 } 12 } 13 result += o2.x; // folded stub 14 return result; 15 } 16 17 // Ion-compile 18 with ({}) {} 19 for (var i = 0; i < 2000; i++) { 20 foo({x: 1}, shapes[i%6], i % 2 == 0); 21 } 22 23 // Bail out in LICM-hoisted guard. 24 // Hit unrelated fallback and add shape to folded stub 25 foo(undefined, shapes[6], false); 26 27 // Get numFixableBailouts to 9 28 for (var i = 0; i < 9; i++) { 29 foo(undefined, shapes[6], false); 30 } 31 32 // Bail out in non-LICM guard. Invalidate. 33 // Add shape to folded stub. 34 foo({x:1}, shapes[7], false); 35 36 // Recompile. 37 for (var i = 0; i < 2000; i++) { 38 foo({x: 1}, shapes[i%8], i % 2 == 0); 39 }