Skip to content

Commit 63aa707

Browse files
GeorgNeismibrunin
authored andcommitted
[Backport] Security bug 1209558
Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/2948652: M86-LTS] Reland "Merged: [compiler] Always record constness dependency for FastDataConstant" This is a reland of 638d1b238d510a349bdd38648add8d5c85bc5f7d after a one-character change. A local variable still has a non-optional type in this version of V8. Original change's description: > Merged: [compiler] Always record constness dependency for FastDataConstant > > Revision: 1bfa5139966fe0c9e8036fe6362b61c483675775 > > BUG=chromium:1209558 > NOTRY=true > NOPRESUBMIT=true > NOTREECHECKS=true > > Change-Id: If4f7243647bcc12ed482796c1353f0717630f6b9 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919823 > Commit-Queue: Georg Neis <[email protected]> > Reviewed-by: Igor Sheludko <[email protected]> > Cr-Commit-Position: refs/branch-heads/9.1@{#59} > Cr-Branched-From: 0e4ac64a8cf298b14034a22f9fe7b085d2cb238d-refs/heads/9.1.269@{#1} > Cr-Branched-From: f565e72d5ba88daae35a59d0f978643e2343e912-refs/heads/master@{#73847} NOTRY=true NOPRESUBMIT=true NOTREECHECKS=true (cherry picked from commit 73666e3f6d6bdbc93ab81cf8b3803dd04930e293) Bug: chromium:1209558 Change-Id: I0c81353882b0f17942fd92ad4181732f941bcb1d Commit-Queue: Georg Neis <[email protected]> Reviewed-by: Igor Sheludko <[email protected]> Cr-Original-Commit-Position: refs/branch-heads/9.1@{#63} Cr-Original-Branched-From: 0e4ac64a8cf298b14034a22f9fe7b085d2cb238d-refs/heads/9.1.269@{#1} Cr-Original-Branched-From: f565e72d5ba88daae35a59d0f978643e2343e912-refs/heads/master@{#73847} Reviewed-by: Artem Sumaneev <[email protected]> Commit-Queue: Victor-Gabriel Savu <[email protected]> Cr-Commit-Position: refs/branch-heads/8.6@{#108} Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1} Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472} Reviewed-by: Michal Klocek <[email protected]>
1 parent 5ddd26e commit 63aa707

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

chromium/v8/src/compiler/access-info.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -892,7 +892,7 @@ PropertyAccessInfo AccessInfoFactory::LookupTransition(
892892
// Transitioning stores *may* store to const fields. The resulting
893893
// DataConstant access infos can be distinguished from later, i.e. redundant,
894894
// stores to the same constant field by the presence of a transition map.
895-
switch (details.constness()) {
895+
switch (dependencies()->DependOnFieldConstness(transition_map_ref, number)) {
896896
case PropertyConstness::kMutable:
897897
return PropertyAccessInfo::DataField(
898898
zone(), map, std::move(unrecorded_dependencies), field_index,

0 commit comments

Comments
 (0)