DescriptionMerged r19024, r19026 into trunk branch.
Make memento checks more stable. Add filler at the end of new space and check if object and memento are on the same new space page.
Elements field of newly allocated JSArray could be left uninitialized in some cases (fast literal case).
BUG=340124
LOG=N
R=jkummerow@chromium.org, machenbach@chromium.org
Committed: https://code.google.com/p/v8/source/detail?r=19029
Patch Set 1 #
Messages
Total messages: 3 (0 generated)
|