Reviewers: ulan,
Description:
Merged r19804, r19890, r19894, r19935 into 3.24 branch.
fix bad access check check
Check that constant is an integer before getting its value in
HGraphBuilder::MatchRotateRight.
Simplify GetEnumPropertyKeys and avoid trimming fixed arrays in large object
space.
Fix generalization with callbacks.
BUG=351263,352070,352588
LOG=N
R=u...@chromium.org
Please review this at https://codereview.chromium.org/222213004/
SVN Base: https://v8.googlecode.com/svn/branches/3.24
Affected files (+45, -90 lines):
M src/handles.cc
M src/hydrogen.cc
M src/objects.h
M src/objects.cc
M src/version.cc
A + test/mjsunit/regress/regress-351263.js
A + test/mjsunit/regress/regress-crbug-351262.js
A + test/mjsunit/regress/regress-migrate-callbacks.js
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
