Comment #1 on issue 2030 by [email protected]: Failures in
mjsunit/mirror-array on x64.
http://code.google.com/p/v8/issues/detail?id=2030
Good news is, I finally found the bugger. Bad news is, it affects all
platforms and was introduced by one of my own changes. I'll cook up a fix
tomorrow. The following is a reliable repro which will serve as a
regression test.
// Flags: --allow-natives-syntax
function a() {
this.x = 1;
}
var aa = new a();
%FinalizeInstanceSize(a);
%DebugPrint(aa);
function b() {
this.z = 23;
this.x = 2;
}
var bb = new b();
%FinalizeInstanceSize(b);
%DebugPrint(bb);
function f(o) {
return o.x;
}
assertSame(1, f(aa));
assertSame(1, f(aa));
assertSame(2, f(bb));
assertSame(2, f(bb));
%OptimizeFunctionOnNextCall(f);
assertSame(1, f(aa));
assertSame(2, f(bb));
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
