• Benedikt Meurer's avatar
    [constant-tracking] Disable `delete` optimization for constant fields. · f0e054c2
    Benedikt Meurer authored
    When using the fast-properties optimization for `delete` with constant
    fields we don't properly invalidate the constness on the original map
    and might thereby just follow the same transition again later with the
    same object, effectively violating the constness of that field. This
    disables the fast-properties optimization for `delete` in case of a
    field marked as "const" as a quick-fix. We might still want to change
    the logic to properly invalidate the "const" bit later.
    
    Bug: chromium:962588, v8:9233
    Change-Id: I1d0a8649d117731a0cd5ebdb4b6d0b22a900f33d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609796Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61484}
    f0e054c2
runtime-object.cc 42.9 KB