Comment #2 on issue 3687 by bugdro...@chromium.org: Crash in
GeneralizeRepresentation
https://code.google.com/p/v8/issues/detail?id=3687#c2
The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8.git/+/bc8c41c08d64f5d051ae82db54d59ae2a167f430
commit bc8c41c08d64f5d051ae82db54d59ae2a167f430
Author: ish...@chromium.org <ish...@chromium.org>
Date: Thu Nov 13 10:56:13 2014
Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with
non-simple transitions.
It started showing after r25253.
BUG=v8:3687
LOG=N
R=verwa...@chromium.org
Review URL: https://codereview.chromium.org/715313003
Cr-Commit-Position: refs/heads/master@{#25324}
[modify]
https://chromium.googlesource.com/v8/v8.git/+/bc8c41c08d64f5d051ae82db54d59ae2a167f430/src/json-parser.h
[modify]
https://chromium.googlesource.com/v8/v8.git/+/bc8c41c08d64f5d051ae82db54d59ae2a167f430/src/objects.cc
[modify]
https://chromium.googlesource.com/v8/v8.git/+/bc8c41c08d64f5d051ae82db54d59ae2a167f430/src/objects.h
[add]
https://chromium.googlesource.com/v8/v8.git/+/bc8c41c08d64f5d051ae82db54d59ae2a167f430/test/mjsunit/regress/regress-3687.js
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
