• Georg Neis's avatar
    [deoptimizer] Fix bug in OptimizedFrame::Summarize · 3353a7d0
    Georg Neis authored
    OptimizedFrame::Summarize is used by debugger features etc
    to inspect the frame of an optimized function (and the virtual frames
    of functions that got inlined). It could end up materializing a JSArray
    with the same backing store as one that would later get left-trimmed,
    resulting in a dangling elements pointer. This CL fixes that by creating
    a fresh copy of the elements store instead.
    
    Bug: chromium:1182647
    Change-Id: Iaf329464520a927b0ba33166cad2524d3752c450
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2748593Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#73330}
    3353a7d0
regress-1182647.js 525 Bytes