2d80e84153
This makes sure that the lowering of {JSCreate} operator during create lowering is only applied to operations where both target and new.target are known to be constructors. R=jarin@chromium.org TEST=mjsunit/regress/regress-crbug-768080 BUG=chromium:774780,chromium:768080 Change-Id: I55a582a3453bba7e14655b594b7714a3940eeaae Reviewed-on: https://chromium-review.googlesource.com/725332 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#48680} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
promises-aplus | ||
test262 | ||
unittests | ||
wasm-spec-tests | ||
webkit | ||
bot_default.gyp | ||
bot_default.isolate | ||
BUILD.gn | ||
default.gyp | ||
default.isolate | ||
optimize_for_size.gyp | ||
optimize_for_size.isolate | ||
perf.gyp | ||
perf.isolate |