• Patrick Thier's avatar
    [turbofan] Handle class constructor · e127f584
    Patrick Thier authored
    Handling of class constructors was moved from CallFunction to Call
    in [1].
    When reducing calls with spread we forward varargs directly to
    CallFunction, if we are spreading to inlined arguments or arguments of
    the outermost function.
    In that case we didn't check for class constructors and therefore didn't
    raise an exception.
    This CL adds checks for class constructors to all JSCall* nodes in
    JSCallReducer that missed them before.
    
    [1] https://crrev.com/c/3186434
    
    Bug: chromium:1260623
    Change-Id: Id39cdfd09ff5aae804ae30d96909518e408c9613
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229369
    Commit-Queue: Patrick Thier <pthier@chromium.org>
    Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#77472}
    e127f584
macro-assembler-ia32.cc 67.9 KB