Source code
Revision control
Copy as Markdown
Other Tools
gczeal(0);
var buf;
var holder = {h: null};
function f(a, v, holder) {
var x = a[0]; // hole-load IC: creates the MElements node
holder.h = {p: v}; // escaping inline allocation: minor-GC safepoint
a[0] = v; // hole-store: reuses the CSE'd MElements node
return x;
}
function main() {
with ({}) {} // keep main out of Ion so f is compiled independently
buf = serialize(new Array(100));
gcparam('minNurseryBytes', 1024*1024);
gcparam('maxNurseryBytes', 1024*1024);
gc();
// Train: hole-load (initLength 0) and append-store (0 == initLength)
// attach LoadDenseElementHole / StoreDenseElementHole on fresh victims.
for (var i = 0; i < 3000; i++) {
var t = deserialize(buf);
f(t, i, holder);
}
for (var i = 0; i < 400000; i++) {
var pad = "x".repeat(32 + 8 * (i % 251)); // 8-byte alignment phase sweep
var a = deserialize(buf);
f(a, 7, holder);
if (a[0] !== 7) {
// Stale store went OOB instead of updating the (moved) array.
quit(3);
}
}
}
main();