• Georg Neis's avatar
    [turbofan] Don't type-check in ObjectRef cast. · 829760a5
    Georg Neis authored
    We use the object<T>() getter to extract the handle from an ObjectRef
    instance and cast it to Handle<T>. In DEBUG mode, the cast does a type
    check which accesses the heap. We must not access the heap though. This
    CL is a quick fix that skips the type check. Eventually we should
    replace the templatized accessor with a subclass-specific one to have
    some safety.
    
    Bug: v8:7790, v8:8316
    Change-Id: I71048be2bc36570cce33b0e680824dd6bc407d14
    Reviewed-on: https://chromium-review.googlesource.com/c/1282963
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#56756}
    829760a5
js-heap-broker.h 16.9 KB