[turbofan] Fix a lazy deopt bug in Array.prototype.map
The bug was that the allocation of the result array (before the loop) was using the outer frame state, thus returning the allocation's result (an array full of holes) as the return value of the map operation in case the allocation triggers a lazy deopt. Bug: chromium:1104514 Change-Id: I9a6db8a5860472e1b438b6b54414938d61e166c1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324249Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#69129}
Showing
Please
register
or
sign in
to comment