Description[turbofan] Fix typing rule for JSCreateArguments.
The typing rule for JSCreateArguments must properly declare rest
parameters as arrays and only consider sloppy and strict arguments
objects as Type::OtherObject.
TBR=jarin@chromium.org
BUG=v8:6262, chromium:712802
Review-Url: https://codereview.chromium.org/2828573004
Cr-Commit-Position: refs/heads/master@{#44712}
Committed: https://chromium.googlesource.com/v8/v8/+/b89ddcf1fc657a1689fe0e88d4441bdce54837c3
Patch Set 1 #Patch Set 2 : Also fix the verifier. #
Messages
Total messages: 17 (11 generated)
|