Description[runtime] %GrowArrayElements doesn't have a native context in TurboFan.
When we compile a growing store in TurboFan, we don't pass a (native)
context to the %GrowArrayElements fallback function, as the whole logic
is actually context independent. However, that means that we need to
bailout early in case the object is a prototype, which requires context
dependent checks in the array protector code.
R=cbruni@chromium.org
BUG=chromium:635798
Committed: https://crrev.com/78727d4362f76cad0e384bdf809d59fba4895195
Cr-Commit-Position: refs/heads/master@{#38491}
Patch Set 1 #
Messages
Total messages: 13 (6 generated)
|