recover-object-bug1175233.js (1662B)
1 // |jit-test| --ion-pruning=on 2 // 3 // Unboxed object optimization might not trigger in all cases, thus we ensure 4 // that Scalar Replacement optimization is working well independently of the 5 // object representation. 6 7 // Ion eager fails the test below because we have not yet created any 8 // template object in baseline before running the content of the top-level 9 // function. 10 if (getJitCompilerOptions()["ion.warmup.trigger"] <= 130) 11 setJitCompilerOption("ion.warmup.trigger", 130); 12 13 // This test checks that we are able to remove the getelem & setelem with scalar 14 // replacement, so we should not force inline caches, as this would skip the 15 // generation of getelem & setelem instructions. 16 if (getJitCompilerOptions()["ion.forceinlineCaches"]) 17 setJitCompilerOption("ion.forceinlineCaches", 0); 18 19 // Prevent the GC from cancelling Ion compilations, when we expect them to succeed 20 gczeal(0); 21 22 var uceFault = function (j) { 23 if (j >= max) 24 uceFault = function (j) { return true; }; 25 return false; 26 } 27 28 function f(j) { 29 var i = Math.pow(2, j) | 0; 30 var obj = { 31 i: i, 32 v: i + i 33 }; 34 // These can only be recovered on bailout iff either we have type 35 // information for the property access in the branch, or the branch is 36 // removed before scalar replacement. 37 assertRecoveredOnBailout(obj, true); 38 assertRecoveredOnBailout(obj.v, true); 39 if (uceFault(j) || uceFault(j)) { 40 // MObjectState::recover should neither fail, 41 // nor coerce its result to an int32. 42 assertEq(obj.v, 2 * i); 43 } 44 return 2 * obj.i; 45 } 46 47 var max = 150; 48 for (var j = 0; j <= max; ++j) { 49 with({}){}; 50 f(j); 51 }