v8/test/mjsunit/es9/regress
Caitlin Potter 3e010af274 [CloneObjectIC] clone MutableHeapNumbers only if !FLAG_unbox_double_fields
Change the macros added in bf84766a2c to
only do the hard work if FLAG_unbox_double_fields is unset (otherwise,
they will attempt to dereference raw float64s, which is bad!)

Also adds a write barrier in CopyPropertyArrayValues for each store if
it's possible that a MutableHeapNumber is cloned.

BUG=chromium:901301, chromium:902965, chromium:903070, v8:7611
R=cbruni@chromium.org, jkummerow@chromium.org, ishell@chromium.org

Change-Id: I224d3c4e7b0a887684bff68985b4d97021ba4cfb
Reviewed-on: https://chromium-review.googlesource.com/c/1323911
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57368}
2018-11-08 19:14:11 +00:00
..
regress-866229.js [CloneObjectIC] copy may_have_interesting_symbols bit to fast result map 2018-08-04 16:48:18 +00:00
regress-866282.js [runtime] fix ClusterFuzz regressions (and remaining nits) in CloneObject 2018-07-25 21:23:05 +00:00
regress-866357.js [runtime] fix ClusterFuzz regressions (and remaining nits) in CloneObject 2018-07-25 21:23:05 +00:00
regress-866727.js [runtime] fix ClusterFuzz regressions (and remaining nits) in CloneObject 2018-07-25 21:23:05 +00:00
regress-866861.js [runtime] fix ClusterFuzz regressions (and remaining nits) in CloneObject 2018-07-25 21:23:05 +00:00
regress-867958.js Reland "Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated" 2018-08-01 00:30:11 +00:00
regress-869342.js Reland "Reland [CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated" 2018-08-01 00:30:11 +00:00
regress-902965.js [CloneObjectIC] clone MutableHeapNumbers only if !FLAG_unbox_double_fields 2018-11-08 19:14:11 +00:00
regress-903070.js [CloneObjectIC] clone MutableHeapNumbers only if !FLAG_unbox_double_fields 2018-11-08 19:14:11 +00:00