-
yangguo authored
Looking up 'name' and 'message' properties at the same time and loading the properties later can cause assertion failure if one of the properties is an accessor and calling it changes the holder map. That may invalidate the other lookup. R=jkummerow@chromium.org BUG=chromium:542101 LOG=N Review URL: https://codereview.chromium.org/1403923002 Cr-Commit-Position: refs/heads/master@{#31229}
1a94bc20
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mozilla | ||
preparser | ||
promises-aplus | ||
simdjs | ||
test262 | ||
unittests | ||
webkit | ||
default.gyp | ||
default.isolate |