4 Commits

Author	SHA1	Message	Date
caitp	c4ee3d9474	[builtins] fix mapcheck in Array.includes fast-case when searching for String ... Use LoadInstanceType() rather than LoadMapInstanceType(), as this part of the code is operating on a JS-accessible HeapObject rather than a Map. BUG=chromium:633883, v8:5162 R=mstarzinger@chromium.org, bmeurer@chromium.org Review-Url: https://codereview.chromium.org/2207903002 Cr-Commit-Position: refs/heads/master@{#38297}	2016-08-03 14:27:38 +00:00
adamk	6a370a6f01	Remove support for Object.observe ... The feature was deprecated in M49 and flagged off in M50. This patch removes it entirely from the codebase. Review URL: https://codereview.chromium.org/1909433003 Cr-Commit-Position: refs/heads/master@{#35714}	2016-04-22 09:02:41 +00:00
adamk	2f9c68cfb1	Pass --harmony-object-observe in tests that depend on it ... This is in preparation for turning the flag off by default. BUG=chromium:552100 LOG=n Review URL: https://codereview.chromium.org/1511293002 Cr-Commit-Position: refs/heads/master@{#32729}	2015-12-09 20:34:16 +00:00
adamk	1f1329d960	Use SetOwnElement when creating splice records in array length setter ... This avoids touching the Array prototype, which may have been tampered with. BUG=chromium:443982 LOG=n Review URL: https://codereview.chromium.org/820503005 Cr-Commit-Position: refs/heads/master@{#25908}	2014-12-19 19:39:35 +00:00