Simon Zünd a40e093856 Move to slow-path in Array#sort if the array is no longer a FastJSArray ... After sorting the work array but before writing the values back into the actual receiver, we have an accessor check. This accessor check needs to be stricter, in order to catch Array prototype protector cell invalidations. R=jgruber@chromium.org Bug: chromium:1077508 Change-Id: I3c3bd4711f9019f9d4423701724319eee9d800a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187171 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#67638}		2020-05-07 08:08:39 +00:00
..
binutils	Use relative paths to OWNERS files	2019-08-12 13:52:52 +00:00
colorama	Use relative paths to OWNERS files	2019-08-12 13:52:52 +00:00
googletest	[googletest] Update fuchsia-sdk deps in BUILD.gn	2020-04-30 15:41:07 +00:00
inspector_protocol	[DevTools] Roll inspector_protocol (V8)	2020-03-21 01:38:12 +00:00
jsoncpp	[tracing] Migrate tracing to Perfetto track events	2020-04-17 21:31:24 +00:00
v8/builtins	Move to slow-path in Array#sort if the array is no longer a FastJSArray	2020-05-07 08:08:39 +00:00
wasm-api	Remove mstarzinger@ from OWNERS files.	2019-12-13 11:13:14 +00:00