[turbofan] Mark {JSCreate} as potentially throwing.
This correctly marks the {JSCreate} operator as potentially throwing, since it might trigger a property access of the 'prototype' property during instantiation. This is observable, can throw (not kNoThrow), might have side-effects (not kNoWrite), or even trigger a lazy deopt event (not kNoDeopt). The inlining logic has been adapted to wire up control projections accordingly. Note that this does not yet take care of the "after" frame-state which is associated with the {JSCreate} node introduced by the inliner. We still might re-evaluate the property access upon lazy deoptimization. R=bmeurer@chromium.org TEST=mjsunit/regress/regress-5638 BUG=v8:5638 Review-Url: https://codereview.chromium.org/2671203003 Cr-Commit-Position: refs/heads/master@{#42981}
Showing
Please
register
or
sign in
to comment