Commit 3238b337 authored by verwaest's avatar verwaest Committed by Commit bot

[builtins] Compare sloppy arguments length with the correct backing store length

BUG=

Review-Url: https://codereview.chromium.org/2579983002
Cr-Commit-Position: refs/heads/master@{#41757}
parent 55e8c2e4
...@@ -56,7 +56,13 @@ inline bool GetSloppyArgumentsLength(Isolate* isolate, Handle<JSObject> object, ...@@ -56,7 +56,13 @@ inline bool GetSloppyArgumentsLength(Isolate* isolate, Handle<JSObject> object,
Object* len_obj = object->InObjectPropertyAt(JSArgumentsObject::kLengthIndex); Object* len_obj = object->InObjectPropertyAt(JSArgumentsObject::kLengthIndex);
if (!len_obj->IsSmi()) return false; if (!len_obj->IsSmi()) return false;
*out = Max(0, Smi::cast(len_obj)->value()); *out = Max(0, Smi::cast(len_obj)->value());
return *out <= object->elements()->length();
FixedArray* parameters = FixedArray::cast(object->elements());
if (object->HasSloppyArgumentsElements()) {
FixedArray* arguments = FixedArray::cast(parameters->get(1));
return *out <= arguments->length();
}
return *out <= parameters->length();
} }
inline bool IsJSArrayFastElementMovingAllowed(Isolate* isolate, inline bool IsJSArrayFastElementMovingAllowed(Isolate* isolate,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment