71012480b7
This fixes a corner case of rewriting the transition trees, where the "interesting symbols" bit was not properly forwarded. Drive-by-fix: Introduce additional checking in Map::ConnectTransition to make it easier for clusterfuzz to detect cases we might have missed. R=mstarzinger@chromium.org Bug: chromium:751109 Change-Id: I3f1a1e6232db9b3694064b3d4e9f37255b018acc Reviewed-on: https://chromium-review.googlesource.com/597669 Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#47075} |
||
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
fuzzer | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
preparser | ||
promises-aplus | ||
test262 | ||
unittests | ||
wasm-spec-tests | ||
webkit | ||
bot_default.gyp | ||
bot_default.isolate | ||
BUILD.gn | ||
default.gyp | ||
default.isolate | ||
optimize_for_size.gyp | ||
optimize_for_size.isolate | ||
perf.gyp | ||
perf.isolate |