3.24.30.1 - v8/v8.git - Git at Google

commit	b2498e12b28a19563de5c70c51cba52f180c1dfe	[log] [tgz]
author	hpayer@chromium.org <hpayer@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>	Mon Feb 03 14:21:46 2014
committer	hpayer@chromium.org <hpayer@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>	Mon Feb 03 14:21:46 2014
tree	eff6d8eecff3349fc3ef5540ac3d2b94a39f44c0
parent	0e76f00b35759b9112b3ad67999ffecff345b56c [diff]

Merged r19024, r19026 into trunk branch.

Make memento checks more stable. Add filler at the end of new space and check if object and memento are on the same new space page.

Elements field of newly allocated JSArray could be left uninitialized in some cases (fast literal case).

BUG=340124
LOG=N
R=jkummerow@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/139133004

git-svn-id: http://v8.googlecode.com/svn/trunk@19029 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/heap-inl.h[diff]
src/heap.cc[diff]
src/hydrogen.cc[diff]
src/mark-compact.cc[diff]
src/objects.cc[diff]
src/spaces.h[diff]
src/version.cc[diff]

7 files changed

tree: eff6d8eecff3349fc3ef5540ac3d2b94a39f44c0