• mstarzinger's avatar
    [builtins] Fix pointer comparison in ToString builtin. · 79aee39f
    mstarzinger authored
    This fixes the bogus {Word32Equal} comparison in the ToString builtin
    implementing Object.prototype.toString to be a pointer-size {WordEqual}
    comparison instead. Comparing just the lower half-word is insufficient
    on 64-bit architectures.
    
    R=jgruber@chromium.org
    TEST=mjsunit/regress/regress-crbug-664506
    BUG=chromium:664506
    
    Review-Url: https://codereview.chromium.org/2496043003
    Cr-Commit-Position: refs/heads/master@{#40963}
    79aee39f
builtins-object.cc 39.3 KB