Commit 6fbe2698 authored by Victor Gomes's avatar Victor Gomes Committed by Commit Bot

[runtime] Add the JSCallRuntime opcode to TryGetScopeInfo

ClusterFuzzer found that a context can be created by
a call to the runtime when checking for context extensions
on the bytecode graph builder.

That happens in large contexts.

Bug: chromium:1019069
Change-Id: I7ab66dceedd56476ab972d7998ef4ca6896dc868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886691Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64605}
parent 8649e430
...@@ -1622,6 +1622,8 @@ base::Optional<ScopeInfoRef> BytecodeGraphBuilder::TryGetScopeInfo() { ...@@ -1622,6 +1622,8 @@ base::Optional<ScopeInfoRef> BytecodeGraphBuilder::TryGetScopeInfo() {
case IrOpcode::kJSGeneratorRestoreContext: case IrOpcode::kJSGeneratorRestoreContext:
case IrOpcode::kOsrValue: case IrOpcode::kOsrValue:
case IrOpcode::kPhi: case IrOpcode::kPhi:
// For a large context, the runtime call is still used.
case IrOpcode::kJSCallRuntime:
return base::nullopt; return base::nullopt;
default: default:
UNREACHABLE(); UNREACHABLE();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment