Version 3.12.0
Fixed Chromium issues: 115100, 129628, 131994, 132727, 132741, 132742, 133211
Fixed V8 issues: 915, 1914, 2034, 2087, 2094, 2134, 2156, 2166, 2172, 2177, 2179, 2185
Added --extra-code flag to mksnapshot to load JS code into the VM before creating the snapshot.
Support 'restart call frame' command in the debugger.
Performance and stability improvements on all platforms.
git-svn-id: http://v8.googlecode.com/svn/trunk@11882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 5aac503..cefa3f8 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -502,6 +502,7 @@
CHECK(IsSharedFunctionInfo());
VerifyObjectField(kNameOffset);
VerifyObjectField(kCodeOffset);
+ VerifyObjectField(kOptimizedCodeMapOffset);
VerifyObjectField(kScopeInfoOffset);
VerifyObjectField(kInstanceClassNameOffset);
VerifyObjectField(kFunctionDataOffset);
@@ -921,6 +922,11 @@
bool DescriptorArray::IsConsistentWithBackPointers(Map* current_map) {
+ Map* elements_transition = elements_transition_map();
+ if (elements_transition != NULL &&
+ !CheckOneBackPointer(current_map, elements_transition)) {
+ return false;
+ }
for (int i = 0; i < number_of_descriptors(); ++i) {
switch (GetType(i)) {
case MAP_TRANSITION: