Reviewers: Mads Ager,
Description:
Merge r8032 to the 3.2 branch
Handle changes to the Object prototype in fast handling of arrays
[email protected]
BUG=v8:1403
TEST=test/mjsunit/regress/regress-1403.js
Please review this at http://codereview.chromium.org/7066018/
SVN Base: http://v8.googlecode.com/svn/branches/3.2/
Affected files:
M src/builtins.cc
M src/version.cc
A + test/mjsunit/regress/regress-1403.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-1403.js
test/mjsunit/regress/regress-1403.js
### END SVN COPY METADATA
Index: src/builtins.cc
===================================================================
--- src/builtins.cc (revision 8032)
+++ src/builtins.cc (working copy)
@@ -378,8 +378,7 @@
array_proto = JSObject::cast(proto);
if (array_proto != global_context->initial_object_prototype()) return
false;
if (array_proto->elements() != heap->empty_fixed_array()) return false;
- ASSERT(array_proto->GetPrototype()->IsNull());
- return true;
+ return array_proto->GetPrototype()->IsNull();
}
Index: src/version.cc
===================================================================
--- src/version.cc (revision 8032)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 2
#define BUILD_NUMBER 10
-#define PATCH_LEVEL 11
+#define PATCH_LEVEL 12
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
Index: test/mjsunit/regress/regress-1403.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
