Commit 5837db41 authored by zhengxing.li's avatar zhengxing.li Committed by Commit bot

X87: [crankshaft] Loads and stores to typed arrays have to reference the backing store holder.

  port 086d4598 (r32644)

  original commit message:
  The backing store is only held alive indirectly via the array buffer
  referenced by the holder (typed array), so it's not enough to keep the
  elements alive (or even just the external pointer loaded from the
  elements).

BUG=

Review URL: https://codereview.chromium.org/1503943002

Cr-Commit-Position: refs/heads/master@{#32648}
parent 4ff9bb07
......@@ -2155,7 +2155,7 @@ class LStoreKeyed final : public LTemplateInstruction<0, 4, 0> {
inputs_[0] = obj;
inputs_[1] = key;
inputs_[2] = val;
inputs_[3] = backing_store_owner
inputs_[3] = backing_store_owner;
}
bool is_fixed_typed_array() const {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment