commit bdc4f54a50293507d9ef51573bab537883560cc8
author Brendon Tiszka <btiszka@gmail.com> Fri Mar 18 05:32:54 2022
committer V8 LUCI CQ <v8-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Mar 21 07:45:09 2022
tree 74f842286611db5071df3796b1effff58b955d49
parent e1e92f8ba77145568e781b47b31ad82535e868bf

Update write barrier when storing HeapNumber to last index.

Bug: chromium:1307610
Change-Id: I60aaa0e58e13b705b5eff4b57411a0ad4a2e9b3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534849
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79538}

src/regexp/regexp-utils.cc

diff --git a/src/regexp/regexp-utils.cc b/src/regexp/regexp-utils.cc
index dabe5ee..b260071 100644
--- a/src/regexp/regexp-utils.cc
+++ b/src/regexp/regexp-utils.cc
@@ -49,7 +49,8 @@
   Handle<Object> value_as_object =
       isolate->factory()->NewNumberFromInt64(value);
   if (HasInitialRegExpMap(isolate, *recv)) {
-    JSRegExp::cast(*recv).set_last_index(*value_as_object, SKIP_WRITE_BARRIER);
+    JSRegExp::cast(*recv).set_last_index(*value_as_object,
+                                         UPDATE_WRITE_BARRIER);
     return recv;
   } else {
     return Object::SetProperty(