• Caitlin Potter's avatar
    [CloneObjectIC] clone MutableHeapNumbers instead of referencing them · bf84766a
    Caitlin Potter authored
    Adds a helper macro "CloneIfMutablePrimitive", which tests if the
    operand is a MutableHeapNumber, and if so, clones it, otherwise
    returning the original value.
    
    Also modifies the signature of "CopyPropertyArrayValues" to take a
    "DestroySource" enum, indicating whether or not the resulting object is
    supplanting the source object or not, and removes all default
    parameters from that macro (which were not used anyways).
    
    This corrects the issue reported in chromium:901301, where
    StaNamedOwnProperty was replacing the value of a MutableHeapNumber
    referenced by both the cloned object and the source object.
    
    BUG=chromium:901301, v8:7611
    R=cbruni@chromium.org, jkummerow@chromium.org
    
    Change-Id: I43df1ddc84dfa4840e680b6affeba452ce0b6629
    Reviewed-on: https://chromium-review.googlesource.com/c/1318096
    Commit-Queue: Caitlin Potter <caitp@igalia.com>
    Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
    Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#57304}
    bf84766a
object-spread-ic.js 3.01 KB