1// Copyright 2015 the V8 project authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5// Flags: --allow-natives-syntax --expose-gc 6 7function Inner() { 8 this.p1 = 0; 9 this.p2 = 3; 10} 11 12function Outer() { 13 this.p3 = 0; 14} 15 16var i1 = new Inner(); 17var i2 = new Inner(); 18var o1 = new Outer(); 19o1.inner = i1; 20// o1.map now thinks "inner" has type Inner.map1. 21// Deprecate Inner.map1: 22i1.p1 = 0.5; 23// Let Inner.map1 die by migrating i2 to Inner.map2: 24print(i2.p1); 25gc(); 26// o1.map's descriptor for "inner" is now a cleared WeakCell; 27// o1.inner's actual map is Inner.map2. 28// Prepare Inner.map3, deprecating Inner.map2. 29i2.p2 = 0.5; 30// Deprecate o1's map. 31var o2 = new Outer(); 32o2.p3 = 0.5; 33o2.inner = i2; 34// o2.map (Outer.map2) now says that o2.inner's type is Inner.map3. 35// Migrate o1 to Outer.map2. 36print(o1.p3); 37// o1.map now thinks that o1.inner has map Inner.map3 just like o2.inner, 38// but in fact o1.inner.map is still Inner.map2! 39 40function loader(o) { 41 return o.inner.p2; 42} 43loader(o2); 44loader(o2); 45%OptimizeFunctionOnNextCall(loader); 46assertEquals(0.5, loader(o2)); 47assertEquals(3, loader(o1)); 48gc(); // Crashes with --verify-heap. 49