-
Mythri A authored
We shouldn't spill weak pointers onto the stack when calling functions that can trigger GC. DynamicMapChecks operator was using feedback loaded from the feedback vector across the TryMigrateInstance function call. The feedback can be a weak pointer to receiver map for monomorphic cases and TryMigrateInstance can trigger a GC. This cl fixes it by holding a holding a strong reference to the feedback. Bug: v8:10774,v8:10582,v8:9684 Change-Id: Ia36f4d8ad46421ae570f41439bc1f0875081deee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336804Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#69338}
d88df03a