v8/test/mjsunit/es7
caitp c4ee3d9474 [builtins] fix mapcheck in Array.includes fast-case when searching for String
Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the
code is operating on a JS-accessible HeapObject rather than a Map.

BUG=chromium:633883, v8:5162
R=mstarzinger@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2207903002
Cr-Commit-Position: refs/heads/master@{#38297}
2016-08-03 14:27:38 +00:00
..
regress [builtins] fix mapcheck in Array.includes fast-case when searching for String 2016-08-03 14:27:38 +00:00
array-includes-receiver.js Reland [builtins] implement Array.prototype.includes in TurboFan 2016-08-03 03:27:43 +00:00
array-includes-to-object-sloppy.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00
array-includes-to-object-strict.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00
array-includes.js [es7] Array.prototype.includes should be unscopable 2016-06-03 18:30:10 +00:00
exponentiation-operator.js Remove --harmony-exponentiation-operator flag 2016-08-02 17:17:35 +00:00
typed-array-includes.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00