diff --git a/src/compiler/linkage.cc b/src/compiler/linkage.cc index fc6b19e714..f76bc60790 100644 --- a/src/compiler/linkage.cc +++ b/src/compiler/linkage.cc @@ -179,6 +179,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) { case Runtime::kNewObjectFromBound: case Runtime::kNewObjectWithAllocationSite: case Runtime::kObjectFreeze: + case Runtime::kObjectSeal: case Runtime::kOwnKeys: case Runtime::kParseJson: case Runtime::kPrepareStep: @@ -202,6 +203,7 @@ bool Linkage::NeedsFrameState(Runtime::FunctionId function) { case Runtime::kStringBuilderJoin: case Runtime::kStringMatch: case Runtime::kStringReplaceGlobalRegExpWithString: + case Runtime::kThrowConstAssignError: case Runtime::kThrowNonMethodError: case Runtime::kThrowNotDateError: case Runtime::kThrowReferenceError: diff --git a/test/mjsunit/compiler/regress-447567.js b/test/mjsunit/compiler/regress-447567.js new file mode 100644 index 0000000000..b6dc653709 --- /dev/null +++ b/test/mjsunit/compiler/regress-447567.js @@ -0,0 +1,15 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --turbo-deoptimization + +assertThrows(function() { + [0].every(function(){ Object.seal((new Int8Array())); }); +}) + +assertThrows(function() { + "use strict"; + const v = 42; + v += 1; +});