- 17 Jun, 2019 1 commit
-
-
Ross McIlroy authored
Bug: v8:8801,v8:8394,v8:9183 Change-Id: I55027b3ba0c78f40d82aaf2d160aaf957d02cab5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662292 Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#62214}
-
- 07 Feb, 2017 1 commit
-
-
mstarzinger authored
This correctly marks the {JSCreate} operator as potentially throwing, since it might trigger a property access of the 'prototype' property during instantiation. This is observable, can throw (not kNoThrow), might have side-effects (not kNoWrite), or even trigger a lazy deopt event (not kNoDeopt). The inlining logic has been adapted to wire up control projections accordingly. Note that this does not yet take care of the "after" frame-state which is associated with the {JSCreate} node introduced by the inliner. We still might re-evaluate the property access upon lazy deoptimization. R=bmeurer@chromium.org TEST=mjsunit/regress/regress-5638 BUG=v8:5638 Review-Url: https://codereview.chromium.org/2671203003 Cr-Commit-Position: refs/heads/master@{#42981}
-