forked from v8/v8
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[compiler] fix bug in inlining of Array.At
The inlined version of Array.At was only checking the kind of the maps, rather than the maps themselves. When the feedback was containing an array map that "supports_fast_array_iteration", then its kind was added to the list of supported kinds. If this Array.at was later called with a non-array map with the same kind, then the object would be wrongly treated as an array. This is now fixed: inlining Array.at checks the maps directly rather than only their kinds. Fixed: chromium:1377775 Change-Id: I6669ffdc04df04a7c9d00d6b9f8bac82dc9cd235 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3981554 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#83946}
- Loading branch information
Darius M
authored and
V8 LUCI CQ
committed
Oct 27, 2022
1 parent
f257ed5
commit 0ce2731
Showing
1 changed file
with
22 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters