X87: [crankshaft] Loads and stores to typed arrays have to reference the backing store holder.
port 086d459847
(r32644)
original commit message:
The backing store is only held alive indirectly via the array buffer
referenced by the holder (typed array), so it's not enough to keep the
elements alive (or even just the external pointer loaded from the
elements).
BUG=
Review URL: https://codereview.chromium.org/1503943002
Cr-Commit-Position: refs/heads/master@{#32648}
This commit is contained in:
parent
4ff9bb070b
commit
5837db4171
@ -2155,7 +2155,7 @@ class LStoreKeyed final : public LTemplateInstruction<0, 4, 0> {
|
||||
inputs_[0] = obj;
|
||||
inputs_[1] = key;
|
||||
inputs_[2] = val;
|
||||
inputs_[3] = backing_store_owner
|
||||
inputs_[3] = backing_store_owner;
|
||||
}
|
||||
|
||||
bool is_fixed_typed_array() const {
|
||||
|
Loading…
Reference in New Issue
Block a user