Reviewers: Mads Ager,
Description:
Merge r8032 to the 3.1 branch
Handle changes to the Object prototype in fast handling of arrays
[email protected]
BUG=v8:1403
TEST=test/mjsunit/regress/regress-1403.js
Please review this at http://codereview.chromium.org/7065023/
SVN Base: http://v8.googlecode.com/svn/branches/3.1/
Affected files:
M src/builtins.cc
M src/version.cc
A + test/mjsunit/regress/regress-1403.js
### BEGIN SVN COPY METADATA
#$ cp branches/bleeding_edge/test/mjsunit/regress/regress-1403.js
test/mjsunit/regress/regress-1403.js
### END SVN COPY METADATA
Index: src/builtins.cc
===================================================================
--- src/builtins.cc (revision 8032)
+++ src/builtins.cc (working copy)
@@ -373,8 +373,7 @@
array_proto = JSObject::cast(proto);
if (array_proto != global_context->initial_object_prototype()) return
false;
if (array_proto->elements() != Heap::empty_fixed_array()) return false;
- ASSERT(array_proto->GetPrototype()->IsNull());
- return true;
+ return array_proto->GetPrototype()->IsNull();
}
Index: src/version.cc
===================================================================
--- src/version.cc (revision 8032)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 1
#define BUILD_NUMBER 8
-#define PATCH_LEVEL 20
+#define PATCH_LEVEL 21
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
Index: test/mjsunit/regress/regress-1403.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
