beb94c5e87
This fixes a corner-case where the call reduction of the aforementioned getter did not simulate the {ToObject} conversion of the receiver value as required by the spec. This caused the wrong prototype to be constant promoted (i.e. {null} instead of wrapper object prototype). R=jarin@chromium.org TEST=mjsunit/regress/regress-crbug-694709 BUG=chromium:694709 Change-Id: Idf3a37071949d9ddaf5ef43974570c06fd31c0c9 Reviewed-on: https://chromium-review.googlesource.com/445818 Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#43376} |
||
---|---|---|
benchmarks | ||
build_overrides | ||
docs | ||
gni | ||
gypfiles | ||
include | ||
infra | ||
samples | ||
src | ||
test | ||
testing | ||
third_party | ||
tools | ||
.clang-format | ||
.gitignore | ||
.gn | ||
.ycm_extra_conf.py | ||
AUTHORS | ||
BUILD.gn | ||
ChangeLog | ||
CODE_OF_CONDUCT.md | ||
codereview.settings | ||
DEPS | ||
LICENSE | ||
LICENSE.fdlibm | ||
LICENSE.strongtalk | ||
LICENSE.v8 | ||
LICENSE.valgrind | ||
Makefile | ||
Makefile.android | ||
OWNERS | ||
PRESUBMIT.py | ||
README.md | ||
snapshot_toolchain.gni | ||
WATCHLISTS |
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://github.com/v8/v8/wiki
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8
and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config
:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*
Contributing
Please follow the instructions mentioned on the V8 wiki.