- 10 Oct, 2012 1 commit
-
-
verwaest@chromium.org authored
This happens when a map A with no descriptors in fast_holey_elements mode first gets some properties, making it share descriptor arrays with a map B to which it transitions. Then map A transitions elements kind to dictionary_elements in map C. C stores the empty_descriptor_array in its own transition array. When adding a property to C, C transitions to D and shares the descriptors. If D dies, a CNLT clears the transition array of C, making the descriptor array of A (and thus also of B) shine through. If a property is now added to an object in state C, it'll inherit all the properties of A (and B). If those properties had high field indices, we do not have a large enough backing store for the single newly added property, and we'll write out of bounds. BUG=chromium:151749 Review URL: https://chromiumcodereview.appspot.com/11017054 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12687 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 15 May, 2012 1 commit
-
-
danno@chromium.org authored
R=mstarzinger@chromium.org BUG=chromium:128018 TEST=test/mjsunit/regress/regress-128018.js Review URL: https://chromiumcodereview.appspot.com/10387130 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11570 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 13 Jan, 2012 1 commit
-
-
yangguo@chromium.org authored
BUG=v8:1898 TEST=mjsunit/regress/regress-1898.js Review URL: http://codereview.chromium.org/9190047 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10396 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 27 Nov, 2009 1 commit
-
-
fschneider@chromium.org authored
Also added a simple test that invokes a JS runtime function in top-level code. Review URL: http://codereview.chromium.org/437081 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3371 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 23 Oct, 2009 1 commit
-
-
sgjesse@chromium.org authored
If we had compiled the comment instead of the code it would have worked. BUG=483 TEST=mjsunit/regress/regress-483.js Review URL: http://codereview.chromium.org/332007 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3120 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 20 Oct, 2009 1 commit
-
-
sgjesse@chromium.org authored
The check for arguments in registers in one of the three versions of GenericBinaryOpStub::GenerateCall was plain wrong. BUG=475 TEST=mjsunit/regress/regress-475.js Review URL: http://codereview.chromium.org/307002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3092 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 04 Mar, 2009 1 commit
-
-
olehougaard authored
Review URL: http://codereview.chromium.org/39126 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1416 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 26 Sep, 2008 1 commit
-
-
christian.plesner.hansen@gmail.com authored
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@386 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 09 Sep, 2008 1 commit
-
-
christian.plesner.hansen@gmail.com authored
Added presubmit step to check copyright. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 22 Aug, 2008 1 commit
-
-
christian.plesner.hansen authored
In the shell sample don't print the result of executing a script, only evaluating expressions. Fixed issue when building samples on Windows using a shared V8 library. Added visibility option on Linux build which makes the generated library 18% smaller. Changed build system to accept multiple build modes in one build and generate seperate objects, libraries and executables for each mode. Removed deferred negation optimization (a * -b => -(a * b)) since this visibly changes operand conversion order. Improved parsing performance by introducing stack guard in preparsing. Without a stack guard preparsing always bails out with stack overflow. git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 03 Jul, 2008 1 commit
-
-
christian.plesner.hansen authored
git-svn-id: http://v8.googlecode.com/svn/trunk@2 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-