1769f892ce
The tail call implementation is hidden behind the --harmony-tailcalls flag, which is off-by-default (and has been unstaged since February). It is known to be broken in a variety of cases, including clusterfuzz security issues (see sample Chromium issues below). To avoid letting the implementation bitrot further on trunk, this patch removes it. Bug: v8:4698, chromium:636914, chromium:724746 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c Reviewed-on: https://chromium-review.googlesource.com/569069 Commit-Queue: Adam Klein <adamk@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#46651}
63 lines
885 B
JavaScript
63 lines
885 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
"use strict";
|
|
|
|
function h() {
|
|
var stack = (new Error("boom")).stack;
|
|
print(stack);
|
|
%DeoptimizeFunction(f1);
|
|
%DeoptimizeFunction(f2);
|
|
%DeoptimizeFunction(f3);
|
|
%DeoptimizeFunction(g);
|
|
%DeoptimizeFunction(h);
|
|
return 1;
|
|
}
|
|
%NeverOptimizeFunction(h);
|
|
|
|
function g(v) {
|
|
return h();
|
|
}
|
|
%SetForceInlineFlag(g);
|
|
|
|
|
|
function f1() {
|
|
var o = {};
|
|
o.__defineGetter__('p', g);
|
|
o.p;
|
|
}
|
|
|
|
f1();
|
|
f1();
|
|
%OptimizeFunctionOnNextCall(f1);
|
|
f1();
|
|
|
|
|
|
function f2() {
|
|
var o = {};
|
|
o.__defineSetter__('q', g);
|
|
o.q = 1;
|
|
}
|
|
|
|
f2();
|
|
f2();
|
|
%OptimizeFunctionOnNextCall(f2);
|
|
f2();
|
|
|
|
|
|
function A() {
|
|
return h();
|
|
}
|
|
|
|
function f3() {
|
|
new A();
|
|
}
|
|
|
|
f3();
|
|
f3();
|
|
%OptimizeFunctionOnNextCall(f3);
|
|
f3();
|