a8b41a0edd
Used incorrect register for referencing RegExp data, so it always failed to match the fast case. When modifiying the object layout, it was possible to make it crash instead. BUG=v8:1236 TEST=test/mjsunit/regress/regress-1236.js Review URL: http://codereview.chromium.org/6635041 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7091 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 |
||
---|---|---|
.. | ||
cctest | ||
es5conform | ||
message | ||
mjsunit | ||
mozilla | ||
sputnik |