Commit 3ce92ce8 authored by Jaroslav Sevcik's avatar Jaroslav Sevcik Committed by Commit Bot

Turn off in-place field representation changes

The problem is with element kinds transitions without going through
runtime (i.e., IC or optimizing compiler).

Bug: chromium:952682
Change-Id: I6fe2bb30a0ea6fecb8f6e0750427cc50cc50f9e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593083Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61158}
parent 053393d9
......@@ -1037,7 +1037,7 @@ DEFINE_GENERIC_IMPLICATION(
v8::tracing::TracingCategoryObserver::ENABLED_BY_NATIVE))
DEFINE_BOOL_READONLY(fast_map_update, false,
"enable fast map update by caching the migration target")
DEFINE_BOOL(modify_field_representation_inplace, true,
DEFINE_BOOL(modify_field_representation_inplace, false,
"enable in-place field representation updates")
DEFINE_INT(max_polymorphic_map_count, 4,
"maximum number of maps to track in POLYMORPHIC state")
......
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f(array, x) {
array.x = x;
array[0] = undefined;
return array;
}
f([1], 1);
f([2], 1);
%HeapObjectVerify(f([3], undefined));
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment