[turbofan] Brokerize JSCreateLowering::ReduceJSCreateGeneratorObject.
This also fixes JSCreateLowering::ReduceJSCreate to use in-object property count after slack tracking. This would still deserve some more bullet-proof treatment; in particular, we should make it somehow hard to access the pre-slack-tracking instance_size and inobject_property_count (and possibly other things that might be derived from the stale instance_size). Bug: v8:7790 Change-Id: Ie374e5a030ec2fe000647e94d848ca0f9ee346f4 Reviewed-on: https://chromium-review.googlesource.com/1138235 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#54471}
Showing
Please
register
or
sign in
to comment