-
Jakob Gruber authored
This fixes a bug in lazy deopts caused by calls to the callback function in Array.prototype.reduce and reduceRight. The deopt continuation expects the *next* iteration's index value but we actually passed the current iteration's value. The user-visible effect of this bug was that sometimes, an unexpected additional call to the callback function would occur. It was introduced by https://crrev.com/c/1934329. Bug: v8:9972,chromium:1049982 Change-Id: Icfd2ef076209e20602f54d4662220e1d4c5d07ee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049850 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66226}
099de337