Commit b434ee97 authored by Georg Neis's avatar Georg Neis Committed by Commit Bot

[csa] Respect --force-slow-path in array iterator's next().

This might have enabled our fuzzing to find the recent bug.

R=bmeurer@chromium.org

Bug: v8:8449
Change-Id: Iaa485061e132a9d20b995478dd9a642e2224f435
Reviewed-on: https://chromium-review.googlesource.com/c/1337588Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57541}
parent e1044d10
......@@ -3459,6 +3459,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
Label if_hole(this, Label::kDeferred);
TNode<Int32T> elements_kind = LoadMapElementsKind(array_map);
TNode<FixedArrayBase> elements = LoadElements(CAST(array));
GotoIfForceSlowPath(&if_generic);
var_value.Bind(LoadFixedArrayBaseElementAsTagged(
elements, Signed(ChangeUint32ToWord(index32)), elements_kind,
&if_generic, &if_hole));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment