1. 21 Oct, 2014 2 commits
  2. 17 Oct, 2014 6 commits
  3. 16 Oct, 2014 1 commit
  4. 15 Oct, 2014 1 commit
  5. 13 Oct, 2014 2 commits
  6. 10 Oct, 2014 1 commit
  7. 09 Oct, 2014 1 commit
  8. 08 Oct, 2014 1 commit
  9. 07 Oct, 2014 1 commit
  10. 06 Oct, 2014 2 commits
  11. 30 Sep, 2014 3 commits
  12. 29 Sep, 2014 4 commits
  13. 19 Sep, 2014 2 commits
  14. 18 Sep, 2014 3 commits
  15. 12 Sep, 2014 2 commits
  16. 10 Sep, 2014 1 commit
  17. 27 Aug, 2014 1 commit
    • adamk@chromium.org's avatar
      Ensure that JSProxy::Fix gives the generated JSObject map a constructor · 71fbe7d4
      adamk@chromium.org authored
      All JSObjects in V8 either have a map()->constructor() field or are
      JSFunctions. JSProxy::Fix, however, was not enforcing this, and
      Object.observe's use of JSObject::GetCreationContext() exposed this.
      
      Note that this is not Object.observe-specific: the API call
      v8::Object::CreationContext() also would have revealed this bug.
      
      This patch chooses Object as a reasonable constructor to put on the
      newly-fixed object's map. Note that this has no effect on the "constructor"
      property in JS. In doing so, I've also tightened up the code underlying
      JSProxy::Fix to only support JSObject and JSFunction as possible output
      types.
      
      BUG=405844
      LOG=N
      R=rossberg@chromium.org, verwaest@chromium.org
      
      Review URL: https://codereview.chromium.org/505303004
      
      git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23466 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
      71fbe7d4
  18. 21 Aug, 2014 2 commits
  19. 19 Aug, 2014 2 commits
  20. 11 Aug, 2014 1 commit
  21. 08 Aug, 2014 1 commit