Version 3.19.14
Fixed crashes when calling new Array(a) with a single argument that could result in creating a holey array with a packed elements kind. (Chromium issue 245480)
Fixed issues in parallel compilation. (Chromium issue 248076)
Performance and stability improvements on all platforms.
git-svn-id: http://v8.googlecode.com/svn/trunk@15100 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 4008181..3b561ee 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -163,7 +163,10 @@
case JS_BUILTINS_OBJECT_TYPE:
JSBuiltinsObject::cast(this)->JSBuiltinsObjectVerify();
break;
- case JS_GLOBAL_PROPERTY_CELL_TYPE:
+ case CELL_TYPE:
+ Cell::cast(this)->CellVerify();
+ break;
+ case PROPERTY_CELL_TYPE:
JSGlobalPropertyCell::cast(this)->JSGlobalPropertyCellVerify();
break;
case JS_ARRAY_TYPE:
@@ -615,9 +618,16 @@
}
+void Cell::CellVerify() {
+ CHECK(IsCell());
+ VerifyObjectField(kValueOffset);
+}
+
+
void JSGlobalPropertyCell::JSGlobalPropertyCellVerify() {
CHECK(IsJSGlobalPropertyCell());
VerifyObjectField(kValueOffset);
+ VerifyObjectField(kTypeOffset);
}