Version 3.25.3 (based on bleeding_edge revision r19643)
Clear optimized code cache in shared function info when code gets deoptimized (Chromium issue 343609).
Fixed constant folding for Math.clz32 (Chromium issue 347906).
Fix JSObject::PrintTransitions (Chromium issue 347912).
Fix handling of constant global variable assignments (Chromium issue 347904).
Removed bogus ASSERT (Chromium issue 347542).
Mark HCompareMap as having Tagged representation (Chromium issue 346636).
Fix crasher in Object.getOwnPropertySymbols (Chromium issue 346141).
Fix the bit massaging code in CompleteParserRecorder::WriteNumber (Chromium issue 346221).
Don't eliminate loads with incompatible types or representations (Chromium issue 346343).
Check that after a weak callback, the handle is either dead or strong (Chromium issue 346061).
Lazy preparsing vs. lazy parsing fix (Chromium issue 346207).
Performance and stability improvements on all platforms.
git-svn-id: http://v8.googlecode.com/svn/trunk@19644 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index e33b46b..626ff00 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -264,8 +264,9 @@
bool JSObject::ElementsAreSafeToExamine() {
- return (FLAG_use_gvn && FLAG_use_allocation_folding) ||
- reinterpret_cast<Map*>(elements()) !=
+ // If a GC was caused while constructing this object, the elements
+ // pointer may point to a one pointer filler map.
+ return reinterpret_cast<Map*>(elements()) !=
GetHeap()->one_pointer_filler_map();
}
@@ -367,7 +368,7 @@
void TypeFeedbackInfo::TypeFeedbackInfoVerify() {
VerifyObjectField(kStorage1Offset);
VerifyObjectField(kStorage2Offset);
- VerifyHeapPointer(type_feedback_cells());
+ VerifyHeapPointer(feedback_vector());
}
@@ -490,7 +491,6 @@
VerifyObjectField(kEndPositionOffset);
VerifyObjectField(kArgumentsOffset);
VerifyObjectField(kScriptOffset);
- VerifyObjectField(kStackTraceOffset);
VerifyObjectField(kStackFramesOffset);
}
@@ -636,7 +636,7 @@
int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
Object* obj = it.rinfo()->target_object();
- if (IsWeakEmbeddedObject(kind(), obj)) {
+ if (IsWeakObject(obj)) {
if (obj->IsMap()) {
Map* map = Map::cast(obj);
CHECK(map->dependent_code()->Contains(