f0e054c2c6
When using the fast-properties optimization for `delete` with constant fields we don't properly invalidate the constness on the original map and might thereby just follow the same transition again later with the same object, effectively violating the constness of that field. This disables the fast-properties optimization for `delete` in case of a field marked as "const" as a quick-fix. We might still want to change the logic to properly invalidate the "const" bit later. Bug: chromium:962588, v8:9233 Change-Id: I1d0a8649d117731a0cd5ebdb4b6d0b22a900f33d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609796 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#61484} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
test262 | ||
torque | ||
unittests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |