1// Copyright 2015 the V8 project authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5// Flags: --allow-natives-syntax --expose-gc 6 7var inner = new Array(); 8inner.a = {x:1}; 9inner[0] = 1.5; 10inner.b = {x:2}; 11assertTrue(%HasFastDoubleElements(inner)); 12 13function foo(o) { 14 return o.field.b.x; 15} 16 17var outer = {}; 18outer.field = inner; 19foo(outer); 20foo(outer); 21foo(outer); 22%OptimizeFunctionOnNextCall(foo); 23foo(outer); 24 25// Generalize representation of field "b" of inner object. 26var v = { get x() { return 0x7fffffff; } }; 27inner.b = v; 28 29gc(); 30 31var boom = foo(outer); 32print(boom); 33assertEquals(0x7fffffff, boom); 34