2 Commits

Author	SHA1	Message	Date
Simon Zünd	e7ca2b7cfe	[array] Fix wrong receiver when copying from the prototype chain ... This CL fixes an issue where getters/setters would get called on a prototype with the wrong receiver. This happens in the pre-processing for Array.p.sort when values get copied down from the prototype chain. R=jgruber@chromium.org Bug: v8:7682 Change-Id: I0d8ff1dc721c33bd721aaca54ffd357b3d2a2096 Reviewed-on: https://chromium-review.googlesource.com/1198767 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Simon Zünd <szuend@google.com> Cr-Commit-Position: refs/heads/master@{#55546}	2018-08-31 11:58:15 +00:00
jgruber	7b4286b84f	Add regression test for crbug.com/v8/7682 ... Bug: v8:7382,v8:7682 Change-Id: I57aa1658e8136334e18390c422eded3713066728 Reviewed-on: https://chromium-review.googlesource.com/1023394 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#52725}	2018-04-23 10:58:15 +00:00