Merge bleeding_edge revision 1419 to trunk. Fixes a GC unsafety that...

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 1419)
+++ src/objects.cc	(working copy)
@@ -4880,6 +4880,7 @@
 
 
 void JSArray::EnsureSize(int required_size) {
+  Handle<JSArray> self(this);
   ASSERT(HasFastElements());
   if (elements()->length() >= required_size) return;
   Handle<FixedArray> old_backing(elements());
@@ -4888,8 +4889,9 @@
   // constantly growing.
   int new_size = required_size + (required_size >> 3);
   Handle<FixedArray> new_backing = Factory::NewFixedArray(new_size);
+  // Can't use this any more now because we may have had a GC!
   for (int i = 0; i < old_size; i++) new_backing->set(i, old_backing->get(i));
-  SetContent(*new_backing);
+  self->SetContent(*new_backing);
 }