Reviewers: ulan,
Description:
Merged r20033, r20138 into 3.24 branch.
Fix TransitionElementsKindStub to handle non-JSArray objects correctly.
Fix missing access check in Runtime_SetPrototype.
BUG=352982,chromium:354123
[email protected]
LOG=N
Please review this at https://codereview.chromium.org/212623002/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+93, -22 lines):
M src/arm/lithium-codegen-arm.cc
M src/code-stubs-hydrogen.cc
M src/code-stubs.h
M src/ia32/lithium-codegen-ia32.cc
M src/mips/lithium-codegen-mips.cc
M src/runtime.cc
M src/version.cc
M src/x64/lithium-codegen-x64.cc
M test/cctest/test-api.cc
A + test/mjsunit/regress/regress-352982.js
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
