forked from v8/v8
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merged: [compiler] fix bug in inlining of Array.At
The inlined version of Array.At was only checking the kind of the maps, rather than the maps themselves. When the feedback was containing an array map that "supports_fast_array_iteration", then its kind was added to the list of supported kinds. If this Array.at was later called with a non-array map with the same kind, then the object would be wrongly treated as an array. This is now fixed: inlining Array.at checks the maps directly rather than only their kinds. Bug: chromium:1377775 (cherry picked from commit 0ce2731) Change-Id: I2398f2f7a1ea37808962ba5eb3d1fe00a54fd614 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990747 Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/branch-heads/10.6@{v8#49} Cr-Branched-From: 41bc743-refs/heads/10.6.194@{#1} Cr-Branched-From: d5f29b9-refs/heads/main@{#82548}
- Loading branch information
Darius M
authored and
V8 LUCI CQ
committed
Nov 7, 2022
1 parent
11e619e
commit 177e8bc
Showing
1 changed file
with
23 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters