f3fb1b7798
Fix an error overwriting the `prototype` property of async generator functions when FLAG_enable_slow_asserts is enabled. Previously, the `initial_async_generator_prototype` field was never written to the native context, and was always undefined. This caused some incorrect runtime behaviour, and would crash when loading the field using the Context::initial_aysnc_generator_prototype accessor when attempting to cast the Undefined oddball to a JSObject. BUG=chromium:771470, v8:5855 R=adamk@chromium.org, verwaest@chromium.org, gsathya@chromium.org Change-Id: I13f2a518c59852bc77c2de1f2468a4eea457609e Reviewed-on: https://chromium-review.googlesource.com/700261 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Caitlin Potter <caitp@igalia.com> Cr-Commit-Position: refs/heads/master@{#48291} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
promises-aplus | ||
test262 | ||
unittests | ||
wasm-spec-tests | ||
webkit | ||
bot_default.gyp | ||
bot_default.isolate | ||
BUILD.gn | ||
default.gyp | ||
default.isolate | ||
optimize_for_size.gyp | ||
optimize_for_size.isolate | ||
perf.gyp | ||
perf.isolate |