LGTM
http://codereview.chromium.org/3117006/diff/1/2 File src/bootstrapper.cc (right): http://codereview.chromium.org/3117006/diff/1/2#newcode1241 src/bootstrapper.cc:1241: HeapObject::cast(string_function->initial_map()->prototype())->map()); I guess this change will only work if the prototype is a fast-case object (otherwise a change of the valueOf function will not introduce a new map). We should ASSERT that this is the case. http://codereview.chromium.org/3117006/diff/1/13 File test/mjsunit/regress/regress-760-1.js (right): http://codereview.chromium.org/3117006/diff/1/13#newcode28 test/mjsunit/regress/regress-760-1.js:28: // See: http://code.google.com/p/v8/issues/detail?id=760 Could you add a short text description as well? http://codereview.chromium.org/3117006/diff/1/14 File test/mjsunit/regress/regress-760-2.js (right): http://codereview.chromium.org/3117006/diff/1/14#newcode28 test/mjsunit/regress/regress-760-2.js:28: // See: http://code.google.com/p/v8/issues/detail?id=760 Ditto http://codereview.chromium.org/3117006/show -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
