• mvstanton's avatar
    Array() in optimized code can create with wrong ElementsKind in corner cases. · 13459c1a
    mvstanton authored
    Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
    makes a stub call that bails out due to the length. Currently, the bailout
    code a) doesn't have the allocation site, and b) wouldn't use it if it did
    because the length is perceived to be too high.
    
    This CL passes the allocation site to the stub call (rather than undefined),
    and alters the bailout code to utilize the feedback.
    
    BUG=
    
    Review URL: https://codereview.chromium.org/1086873003
    
    Cr-Commit-Position: refs/heads/master@{#27857}
    13459c1a
Name
Last commit
Last update
benchmarks Loading commit data...
build Loading commit data...
include Loading commit data...
samples Loading commit data...
src Loading commit data...
test Loading commit data...
testing Loading commit data...
third_party/binutils Loading commit data...
tools Loading commit data...
.clang-format Loading commit data...
.gitignore Loading commit data...
.ycm_extra_conf.py Loading commit data...
AUTHORS Loading commit data...
BUILD.gn Loading commit data...
ChangeLog Loading commit data...
DEPS Loading commit data...
LICENSE Loading commit data...
LICENSE.strongtalk Loading commit data...
LICENSE.v8 Loading commit data...
LICENSE.valgrind Loading commit data...
Makefile Loading commit data...
Makefile.android Loading commit data...
Makefile.nacl Loading commit data...
OWNERS Loading commit data...
PRESUBMIT.py Loading commit data...
README.md Loading commit data...
WATCHLISTS Loading commit data...
codereview.settings Loading commit data...