On 2014/06/23 15:13:32, Jakob wrote:
You can't just call Push()/Pop()/Drop() arbitrarily.

Ok I see what you mean, and actually you simply need something like a property
read deoptimization in the first argument and it will crash:

    // Flags: --allow-natives-syntax --noalways-opt

    function callsFReceiver(o) {
        return [].f.call(o.m, 1, 2, 3);
    }

    Array.prototype.f = function() {
        return this.m;
    };


    var o1 = {m: 1};
    var o2 = {a: 0, m:1};

    var r1 = callsFReceiver(o1);
    callsFReceiver(o1);
    %OptimizeFunctionOnNextCall(callsFReceiver);
    var r2 = callsFReceiver(o1);
    callsFReceiver(o2);
    var r3 = callsFReceiver(o1);

    print(r1 === r2);
    print(r2 === r3);

    callsFReceiver(o1);
    callsFReceiver(o1);
    %OptimizeFunctionOnNextCall(callsFReceiver);
    callsFReceiver(o1);

I was indeed arbitrarily calling the stack manipulation methods.

https://codereview.chromium.org/335683002/

--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to