0f94c96cbc
The test demonstrates a bad interaction between arguments object materialization, escape analysis and exception handling. We can return a wrong arguments object if we materialize arguments object (using f.arguments) and then throw around f's frame so that f does not clean up the materialized frame information (see the MaterializedObjectStore in deoptimizer.h/.cc). If we enter another function that has the same frame pointer and request an arguments object of (or lazily deoptimize) that function, we can get the materialized object of the original function. We should clean up the materialized object store when we unwind the stack. BUG=v8:3985 LOG=n Review URL: https://codereview.chromium.org/1032623003 Cr-Commit-Position: refs/heads/master@{#27406} |
||
---|---|---|
benchmarks | ||
build | ||
include | ||
samples | ||
src | ||
test | ||
testing | ||
third_party/binutils | ||
tools | ||
.clang-format | ||
.gitignore | ||
.ycm_extra_conf.py | ||
AUTHORS | ||
BUILD.gn | ||
ChangeLog | ||
codereview.settings | ||
DEPS | ||
LICENSE | ||
LICENSE.strongtalk | ||
LICENSE.v8 | ||
LICENSE.valgrind | ||
Makefile | ||
Makefile.android | ||
Makefile.nacl | ||
OWNERS | ||
PRESUBMIT.py | ||
README.md | ||
WATCHLISTS |
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://code.google.com/p/v8/
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8
and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config
:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*