| commit | 47684e11aa727878fff5a80fdbb6e4104d0e870c | [log] [tgz] |
|---|---|---|
| author | danno@chromium.org <danno@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> | Mon Sep 12 11:36:07 2011 |
| committer | danno@chromium.org <danno@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00> | Mon Sep 12 11:36:07 2011 |
| tree | b9aaa7b8e41b89d5cfd2abfe5cefea42f1f2b40d | |
| parent | cebb40ef14a909e3671ad4b5eab7fbe789d56c6f [diff] |
Merge r9213 into the 3.3 branch. This change fixes crashes caused by trying to change element property definitions, freeze, seal or preventExtensions on objects with external elements arrays. R=ricow@chromium.org BUG=95920 TEST=test/mjsunit/regress/regress-95920.js Review URL: http://codereview.chromium.org/7787030 git-svn-id: http://v8.googlecode.com/svn/branches/3.3@9237 ce2b1a6d-e550-0410-aec6-3dcde31c8c00