-
Jakob Gruber authored
This fixes a bug in lazy deopts caused by calls to the callback function in Array.prototype.reduce and reduceRight. The deopt continuation expects the *next* iteration's index value but we actually passed the current iteration's value. The user-visible effect of this bug was that sometimes, an unexpected additional call to the callback function would occur. It was introduced by https://crrev.com/c/1934329. Bug: v8:9972,chromium:1049982 Change-Id: Icfd2ef076209e20602f54d4662220e1d4c5d07ee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049850 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66226}
099de337
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |