• Michael Starzinger's avatar
    [turbofan] Correct lazy deopt by {JSCreate} operation. · 6ee0b6ce
    Michael Starzinger authored
    This adds support for deoptimizing into the JSConstructStub after the
    receiver instantiation but before the actual constructor invocation.
    Such a deoptimization point is needed for cases where instantiation
    might be observed (e.g. when new.target is a proxy) and hence might
    trigger a deopt.
    
    We use this new deoptimization point for the "after" frame-state the
    inliner attaches to {JSCreate} nodes being inserted when constructor
    calls are being inlined.
    
    R=jarin@chromium.org
    TEST=mjsunit/regress/regress-5638b
    BUG=v8:5638
    
    Change-Id: I7c72c807ee8fb76d12e0e9ccab86d970ab1a0efd
    Reviewed-on: https://chromium-review.googlesource.com/440125Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
    Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
    Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#43149}
    6ee0b6ce
regress-5638b.js 993 Bytes