tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

trial-inline-gc-4.js (933B)


      1 // 1) Trial inline f => g1 => h.
      2 // 2) Make f => g1 call site polymorphic by calling f => g2.
      3 //    This gets rid of the ICScript::inlinedChildren_ edge.
      4 // 3) Restore f => g1.
      5 // 4) Trigger a shrinking GC from f => g1 => h (h not trial-inlined; h preserves Baseline code)
      6 //    This purges h's inlined ICScript.
      7 // 5) Call f => g1 => h (trial inlined). This must not use the discarded ICScript.
      8 function h(i, x) {
      9    if (i === 900) {
     10        // Step 4.
     11        gc(this, "shrinking");
     12    }
     13    return x + 1;
     14 }
     15 function g2(i, x) {
     16    if (i === 820) {
     17        // Step 3.
     18        callee = g1;
     19    }
     20    return h(i, x) + x;
     21 }
     22 function g1(i, x) {
     23    if (i === 800) {
     24        // Step 2.
     25        callee = g2;
     26    }
     27    if (i === 900) {
     28        // Step 4.
     29        h(i, x);
     30    }
     31    return h(i, x) + x;
     32 }
     33 
     34 var callee = g1;
     35 
     36 function f() {
     37    for (var i = 0; i < 1000; i++) {
     38        callee(i, i);
     39        callee(i, "foo");
     40    }
     41 }
     42 f();