Description[turbofan] Fix invalid lowering of let variable in TDZ.
This fixes JSNativeContextSpecialization to not lower JSLoadGlobal and
JSStoreGlobal nodes if the global variable has morphed into a context
variable that is currently within a TDZ. Scary variable binding is being
scary!
R=bmeurer@chromium.org
TEST=cctest/test-decls/Regress3941 --turbo-filter="f"
BUG=v8:4470
LOG=n
Committed: https://crrev.com/4de969cebe8288a96b77e319f4fce113c979b5d7
Cr-Commit-Position: refs/heads/master@{#31405}
Patch Set 1 #Patch Set 2 : Rebased. #
Dependent Patchsets: Messages
Total messages: 7 (2 generated)
|