• Marja Hölttä's avatar
    [builtins] Unify ArrayPrototypeSlice & ReduceArrayPrototypeSlice · 0d42c9d0
    Marja Hölttä authored
    They need to agree about when to delegate to CloneFastJSArray, since it
    produces arrays which are potentially COW. If they don't agree, TF
    generates code which produces a COW array and then expects it to be
    non-COW -> immediate deopt.
    
    This CL gets rid of the discrepancy in the case when there's exactly
    one argument and it's the number 0.
    
    Some corner cases remain, e.g., 1st argument not a number but ToInteger
    returns 0. These should be extremely rare in the real world.
    
    Bug: v8:12194
    Change-Id: I10230245c97f8997da4d79702f29ebff11297229
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3147910
    Commit-Queue: Marja Hölttä <marja@chromium.org>
    Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#76745}
    0d42c9d0
array-slice.tq 7.93 KB