[elements] Omit fast path in PrependElementIndices
In PrependElementIndicesImpl we sort a FixedArray of indices potentially containing HeapNumbers. During the string conversion we might trigger a GC. This in turn might try to read a slot where we previously had a HeapNumber but the sort sneaked a SMI in there which is not a valid pointer. BUG=chromium:630561 Review-Url: https://codereview.chromium.org/2173653003 Cr-Commit-Position: refs/heads/master@{#37993}
Showing
Please
register
or
sign in
to comment