Description[builtins] NonNumberToNumber and StringToNumber now use CallRuntime instead of TailCallRuntime
With the tail call, pointers to the JS heap could be pushed on a
js-to-wasm frame. On the js-to-wasm frame, however, this pointer would
not be updated by the GC.
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com, v8-mips-ports@googlegroups.com
BUG=617084
TEST=mjsunit/wasm/gc-frame.js:GCInJSToWasmTest()
Committed: https://crrev.com/b5c69cbf39192b7efc12ae40406c8bd55a44419b
Cr-Commit-Position: refs/heads/master@{#37132}
Patch Set 1 #
Total comments: 4
Patch Set 2 : Address comments #
Messages
Total messages: 11 (4 generated)
|