• Dominik Inführ's avatar
    [heap] Invalidate objects unconditionally · a2db7166
    Dominik Inführ authored
    InvalidateRecordedSlots needs to invalidate old-to new objects
    unconditionally. Checking slot_set_[OLD_TO_NEW] is not enough, since the
    sweeping_slot_set_ could still contain slots.
    
    ClearRecordedSlot in MigrateFastToFast is not necessary as well. This is
    only required in DeleteObjectPropertyFast since we might potentially
    shrink the object.
    
    Bug: chromium:1008301,chromium:1008046
    Change-Id: If2c757a619b52d070825e4faadce7710eae61a07
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1826717Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#63985}
    a2db7166
js-objects.cc 224 KB