DescriptionMerge r9213 into the 3.3 branch.
This change fixes crashes caused by trying to change element property definitions, freeze, seal or preventExtensions on objects with external elements arrays.
R=ricow@chromium.org
BUG=95920
TEST=test/mjsunit/regress/regress-95920.js
Committed: http://code.google.com/p/v8/source/detail?r=9237
Patch Set 1 #Patch Set 2 : '' #
Messages
Total messages: 2 (0 generated)
|