caitp
|
c4ee3d9474
|
[builtins] fix mapcheck in Array.includes fast-case when searching for String
Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the
code is operating on a JS-accessible HeapObject rather than a Map.
BUG=chromium:633883, v8:5162
R=mstarzinger@chromium.org, bmeurer@chromium.org
Review-Url: https://codereview.chromium.org/2207903002
Cr-Commit-Position: refs/heads/master@{#38297}
|
2016-08-03 14:27:38 +00:00 |
|