758816f438
In GetOwnFastDataPropertyFromHeap, we read a property value then compare it with the expected representation. We already had code to bail out of that particular optimization if there was a mismatch, however it missed the case of expected representation being a HeapObject, and when a Smi value was found. The fix is to use the excellent pre-existing method Object::FitsRepresentation() to make this check. Thusly, all cases are handled. Bug: chromium:1225607, v8:7790 Change-Id: I7d9b1b7722d9691cf5427f8456a6deb466dda0d3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3008218 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#75587} |
||
---|---|---|
.. | ||
benchmarks | ||
bigint | ||
cctest | ||
common | ||
debugger | ||
debugging | ||
fuzzer | ||
fuzzilli | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |