diff options
| author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2020-01-20 13:40:20 +0100 |
|---|---|---|
| committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2020-01-22 12:41:23 +0000 |
| commit | 7961cea6d1041e3e454dae6a1da660b453efd238 (patch) | |
| tree | c0eeb4a9ff9ba32986289c1653d9608e53ccb444 /chromium/v8/src/runtime/runtime-array.cc | |
| parent | b7034d0803538058e5c9d904ef03cf5eab34f6ef (diff) | |
| download | qtwebengine-chromium-7961cea6d1041e3e454dae6a1da660b453efd238.tar.gz | |
BASELINE: Update Chromium to 78.0.3904.130
Change-Id: If185e0c0061b3437531c97c9c8c78f239352a68b
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Diffstat (limited to 'chromium/v8/src/runtime/runtime-array.cc')
| -rw-r--r-- | chromium/v8/src/runtime/runtime-array.cc | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/chromium/v8/src/runtime/runtime-array.cc b/chromium/v8/src/runtime/runtime-array.cc index f35e72a666f..6190b16cff1 100644 --- a/chromium/v8/src/runtime/runtime-array.cc +++ b/chromium/v8/src/runtime/runtime-array.cc @@ -272,7 +272,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) { // If the receiver is not a special receiver type, and the length is a valid // element index, perform fast operation tailored to specific ElementsKinds. - if (!object->map().IsSpecialReceiverMap() && len < kMaxUInt32 && + if (!object->map().IsSpecialReceiverMap() && + len <= JSObject::kMaxElementCount && JSObject::PrototypeHasNoElements(isolate, JSObject::cast(*object))) { Handle<JSObject> obj = Handle<JSObject>::cast(object); ElementsAccessor* elements = obj->GetElementsAccessor(); @@ -283,8 +284,10 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) { return *isolate->factory()->ToBoolean(result.FromJust()); } - // Otherwise, perform slow lookups for special receiver types + // Otherwise, perform slow lookups for special receiver types. for (; index < len; ++index) { + HandleScope iteration_hs(isolate); + // Let elementK be the result of ? Get(O, ! ToString(k)). Handle<Object> element_k; { |