1. 17 Jun, 2019 1 commit
  2. 07 Feb, 2017 1 commit
    • mstarzinger's avatar
      [turbofan] Mark {JSCreate} as potentially throwing. · e34f5366
      mstarzinger authored
      This correctly marks the {JSCreate} operator as potentially throwing,
      since it might trigger a property access of the 'prototype' property
      during instantiation. This is observable, can throw (not kNoThrow),
      might have side-effects (not kNoWrite), or even trigger a lazy deopt
      event (not kNoDeopt). The inlining logic has been adapted to wire up
      control projections accordingly.
      
      Note that this does not yet take care of the "after" frame-state which
      is associated with the {JSCreate} node introduced by the inliner. We
      still might re-evaluate the property access upon lazy deoptimization.
      
      R=bmeurer@chromium.org
      TEST=mjsunit/regress/regress-5638
      BUG=v8:5638
      
      Review-Url: https://codereview.chromium.org/2671203003
      Cr-Commit-Position: refs/heads/master@{#42981}
      e34f5366