6630a1f111
This disallows speculation after deoptimization from any of Array.{forEach,map,filter,find} due to CheckMap fails. Such CheckMap fails happen if the builtins' function argument causes the map of the array to change. The js-call-lowering refrains from optimizing builtins for which speculation was disallowed. Bug: v8:6898, v8:7127 Change-Id: Ied6696f8fb023ee404fb82e9d37bfb061f293854 Reviewed-on: https://chromium-review.googlesource.com/819354 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#50069} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
promises-aplus | ||
test262 | ||
unittests | ||
wasm-spec-tests | ||
webkit | ||
bot_default.gyp | ||
bot_default.isolate | ||
BUILD.gn | ||
default.gyp | ||
default.isolate | ||
optimize_for_size.gyp | ||
optimize_for_size.isolate | ||
perf.gyp | ||
perf.isolate |