In V8, executing the following code:
```js
Object.defineProperty(Array.prototype, Symbol.iterator, { writable: false })
```
does not actually change the value or behavior of
`Array.prototype[Symbol.iterator]` (assuming the value remains the same).
However, V8 still triggers `UpdateProtector` and internally calls
`InvalidateArrayIteratorLookupChain`. I am not quite sure if this
invalidation is necessary. This causes subsequent JIT optimizations related
to array iteration to be invalidated, resulting in degraded performance.
demo:
```js
Object.defineProperty(Array.prototype, Symbol.iterator, { writable: false })
function test(...args) {
if (arguments.length > 10) return 0;
return 1 + test(1, ...args);
}
var t;
for (let k = 0; k < 10000; k += 1) {
t = test();
}
```
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups
"v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
To view this discussion visit
https://groups.google.com/d/msgid/v8-dev/aab85f06-5aee-4be7-9e80-588d27a8b5acn%40googlegroups.com.
