de7352db92
V8 stores this information directly in the map of the wrapper, however, it is not invalidated when the prototype of the wrapper is changed, so once the bit is set, it is no longer possible to override valueOf. This bug is currently hidden in Chrome since the i18n extension always modifies the String.prototype, and so the optimization never kicks in. Disabling the optimization temporarily allows for snapshotting i18n now. BUG=v8:2855 R=yangguo@chromium.org TEST=mjsunit/regress/regress-2855.js Review URL: https://codereview.chromium.org/23060030 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16292 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 |
||
---|---|---|
benchmarks | ||
build | ||
include | ||
preparser | ||
samples | ||
src | ||
test | ||
tools | ||
.gitignore | ||
AUTHORS | ||
ChangeLog | ||
DEPS | ||
LICENSE | ||
LICENSE.strongtalk | ||
LICENSE.v8 | ||
LICENSE.valgrind | ||
Makefile | ||
Makefile.android | ||
Makefile.nacl | ||
OWNERS | ||
PRESUBMIT.py |