bug1812508.js (1494B)
1 let toBeIncremented = 0; 2 function megamorphicGetIncremented(thisIsMegamorphic, thisIsAlwaysTrue) { 3 // We need this to always evaluate as foo, and have an else clause which 4 // would bail if we ever hit it. 5 let key = thisIsAlwaysTrue ? "foo" : thisIsMegamorphic.bob; 6 7 // The first megamorphic load: 8 if (!thisIsMegamorphic[key]) { 9 // The store which invalidates it 10 thisIsMegamorphic[key] = ++toBeIncremented; 11 } 12 // The megamorphic load which was bugged 13 return thisIsMegamorphic[key]; 14 } 15 16 // We just need enough shapes to go megamorphic. Put in a bunch though 17 // just to be sure 18 let objShapes = [ 19 {a: 1}, 20 // We need the shapes to occasionally have "foo" defined, but be false, 21 // otherwise stub folding will mean we don't go megamorphic because 22 // we'll just attach "Missing" which in our case just differs by a 23 // single shape guard. 24 {b: 1, baz: 2, foo: false}, 25 {c: 1}, 26 {d: 1, baz: 2, foo: false}, 27 {e: 1}, 28 {f: 1, baz: 2, foo: false}, 29 {g: 1}, 30 {h: 1, baz: 2, foo: false}, 31 {i: 1}, 32 {j: 1, baz: 2, foo: false}, 33 {k: 1}, 34 {l: 1, baz: 2, foo: false}, 35 {m: 1}, 36 {n: 1, baz: 2, foo: false}, 37 {o: 1}, 38 {p: 1, baz: 2, foo: false}, 39 {q: 1}, 40 {r: 1, baz: 2, foo: false}, 41 {s: 1}, 42 {t: 1, baz: 2, foo: false}, 43 ]; 44 let objs = []; 45 for (let i = 0; i < 100; i++) { 46 let obj = Object.assign({}, objShapes[i % objShapes.length]); 47 objs.push(obj); 48 } 49 50 for (let i = 1; i < 100; i++) { 51 let id = megamorphicGetIncremented(objs[i], true); 52 assertEq(id, i); 53 }