Chromium Code Reviews

Unified Diff: src/crankshaft/hydrogen.cc

Issue 1584303002: [crankshaft] Don't inline array indexOf operations if receiver's proto is not a JSObject. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments.
Jump to:
View side-by-side diff with in-line comments
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-577112.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/crankshaft/hydrogen.cc
diff --git a/src/crankshaft/hydrogen.cc b/src/crankshaft/hydrogen.cc
index f74b18297d5eb9f5ed14e505be2752d0d1020bad..2ff8722c8471f1368287264d2ad6b0ff3ee82675 100644
--- a/src/crankshaft/hydrogen.cc
+++ b/src/crankshaft/hydrogen.cc
@@ -9058,6 +9058,7 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
case kArrayLastIndexOf: {
if (receiver_map.is_null()) return false;
if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
+ if (!receiver_map->prototype()->IsJSObject()) return false;
ElementsKind kind = receiver_map->elements_kind();
if (!IsFastElementsKind(kind)) return false;
if (receiver_map->is_observed()) return false;
« no previous file with comments | « no previous file | test/mjsunit/regress/regress-crbug-577112.js » ('j') | no next file with comments »

Powered by Google App Engine