Version 3.1.1
Perform security checks before fetching the value in Object.getOwnPropertyDescriptor.
Fixed a bug in Array.prototype.splice triggered by passing no arguments.
Fixed bugs in -0 in arithmetic and in Math.pow.
Fixed bugs in the register allocator and in switching from optimized to unoptimized code.
git-svn-id: http://v8.googlecode.com/svn/trunk@6588 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index f9c57e6..c8246c8 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -158,6 +158,9 @@
case SHARED_FUNCTION_INFO_TYPE:
SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify();
break;
+ case JS_MESSAGE_OBJECT_TYPE:
+ JSMessageObject::cast(this)->JSMessageObjectVerify();
+ break;
#define MAKE_STRUCT_CASE(NAME, Name, name) \
case NAME##_TYPE: \
@@ -296,6 +299,19 @@
}
+void JSMessageObject::JSMessageObjectVerify() {
+ CHECK(IsJSMessageObject());
+ CHECK(type()->IsString());
+ CHECK(arguments()->IsJSArray());
+ VerifyObjectField(kStartPositionOffset);
+ VerifyObjectField(kEndPositionOffset);
+ VerifyObjectField(kArgumentsOffset);
+ VerifyObjectField(kScriptOffset);
+ VerifyObjectField(kStackTraceOffset);
+ VerifyObjectField(kStackFramesOffset);
+}
+
+
void String::StringVerify() {
CHECK(IsString());
CHECK(length() >= 0 && length() <= Smi::kMaxValue);