[field type tracking] Fix handling of cleared WeakCells
authorjkummerow <jkummerow@chromium.org>
Wed, 23 Sep 2015 12:35:21 +0000 (05:35 -0700)
committerCommit bot <commit-bot@chromium.org>
Wed, 23 Sep 2015 12:35:36 +0000 (12:35 +0000)
commitafa60ff604bf41cacd08a8364e8a70a2b5f69d30
tree288247404f1fcc048d49eb98a3596880b85c21b9
parent0e842418835eea85886a06cf37052895bc8a17db
[field type tracking] Fix handling of cleared WeakCells

Whenever a generalization is computed, the inputs must be checked for being cleared, and if they are, the generalization must be Type::Any.

Hopefully this fixes Chromium issue 527994 as well.

BUG=v8:4325,chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1361103002

Cr-Commit-Position: refs/heads/master@{#30887}
src/accessors.cc
src/lookup.cc
src/objects.cc
src/objects.h
test/mjsunit/mjsunit.status
test/mjsunit/regress/regress-4325.js [new file with mode: 0644]