Ensure object literal element boilerplates aren't modified.
authormvstanton <mvstanton@chromium.org>
Mon, 30 Mar 2015 09:19:58 +0000 (02:19 -0700)
committerCommit bot <commit-bot@chromium.org>
Mon, 30 Mar 2015 09:20:09 +0000 (09:20 +0000)
commit7c347c545e33d279b5aa476e754a5358201be846
treef68fa9bb510024ac78d8e57bfb559f50429157b4
parentf303b81bde52ba45228aa26a69a2ac25c01c10b3
Ensure object literal element boilerplates aren't modified.

A bug allows JSObject literals with elements to have the elements in the
boilerplate modified.

BUG=466993
LOG=N

Review URL: https://codereview.chromium.org/1037273002

Cr-Commit-Position: refs/heads/master@{#27511}
13 files changed:
src/arm/full-codegen-arm.cc
src/arm64/full-codegen-arm64.cc
src/ast.cc
src/ast.h
src/compiler/ast-graph-builder.cc
src/full-codegen.cc
src/full-codegen.h
src/hydrogen.cc
src/ia32/full-codegen-ia32.cc
src/mips/full-codegen-mips.cc
src/runtime/runtime-literals.cc
src/x64/full-codegen-x64.cc
test/mjsunit/regress/regress-466993.js [new file with mode: 0644]