AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[csa] Respect --force-slow-path in array iterator's next().

Browse Source 
This might have enabled our fuzzing to find the recent bug.

R=bmeurer@chromium.org

Bug: v8:8449
Change-Id: Iaa485061e132a9d20b995478dd9a642e2224f435
Reviewed-on: https://chromium-review.googlesource.com/c/1337588
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57541}
This commit is contained in:
Georg Neis 2018-11-15 13:57:20 +01:00 committed by Commit Bot
parent e1044d1007
commit b434ee9795
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/builtins/builtins-array-gen.cc
View File

@ -3459,6 +3459,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
Label if_hole(this, Label::kDeferred);
TNode<Int32T> elements_kind = LoadMapElementsKind(array_map);
TNode<FixedArrayBase> elements = LoadElements(CAST(array));
GotoIfForceSlowPath(&if_generic);
var_value.Bind(LoadFixedArrayBaseElementAsTagged(
elements, Signed(ChangeUint32ToWord(index32)), elements_kind,
&if_generic, &if_hole));