- 05 Mar, 2019 1 commit
-
-
Mike Stanton authored
In the recent port of reduce() and reduceRight(), a check for a length change during the loop (standard for iterating builtins) was omitted. We did get array bounds check protection, however it didn't expose the issue in our tests because the bounds check is against the backing store length, not against the length in the referring JSArray. Also added a test for reduceRight(). R=jgruber@chromium.org Bug: chromium:937676 Change-Id: I76e22e0d71965bff84a0822b1df5dc818a00b50e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1503732Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#60033}
-
- 05 Mar, 2018 1 commit
-
-
Sigurd Schneider authored
Bug: v8:7495 Change-Id: Id929804e0d0f78c17d81d07cd6a5c5e571449d35 Reviewed-on: https://chromium-review.googlesource.com/947974Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#51720}
-
- 25 Jan, 2018 1 commit
-
-
Sigurd Schneider authored
Array.p.reduce[Right] did not correctly treat holey arrays when dealing with mixed holey/non-holey receiver maps. Bug: chromium:804956 Change-Id: Ic22f64a1beeb93005809948299cde1f1d21a0f19 Reviewed-on: https://chromium-review.googlesource.com/883241Reviewed-by: Michael Stanton <mvstanton@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#50864}
-
- 19 Jan, 2018 1 commit
-
-
Sigurd Schneider authored
Change-Id: If1a3d08c1fca73234d94db6b527f5d11d10aa6cc Reviewed-on: https://chromium-review.googlesource.com/867032 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#50722}
-
- 15 Jan, 2018 1 commit
-
-
Sigurd Schneider authored
Change-Id: Idae3ceb3f8de79ab94ccaa1961d025242a51714d Reviewed-on: https://chromium-review.googlesource.com/866715Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Daniel Clifford <danno@chromium.org> Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#50580}
-
- 21 Dec, 2017 2 commits
-
-
Daniel Clifford authored
Bug: v8:1956 Change-Id: I785986ed20e60e21966abe82a1567d239b22b416 Reviewed-on: https://chromium-review.googlesource.com/840026Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Daniel Clifford <danno@chromium.org> Cr-Commit-Position: refs/heads/master@{#50283}
-
Daniel Clifford authored
Bug: v8:1956,v8:4869 Change-Id: Id5822319c14142be2dd984c922b2b65717b96dee Reviewed-on: https://chromium-review.googlesource.com/803974 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50261}
-
- 15 Sep, 2017 1 commit
-
-
Camillo Bruni authored
Given that the index we use is checked to be in array index range there is no need for a costly ToString conversion. All involved helpers for lookup up properties directly support Smi/HeapNumber indices directly. Cleanup: Rename GotoUnlessNumberLessThan => GotoIfNumberGreaterThanOrEqual Change-Id: Iaddc4940f5d984572aa218d568ca71bf694cee74 Reviewed-on: https://chromium-review.googlesource.com/640388 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#48039}
-
- 21 Mar, 2017 1 commit
-
-
danno authored
BUG=v8:1956 Review-Url: https://codereview.chromium.org/2752273003 Cr-Commit-Position: refs/heads/master@{#43987}
-
- 22 Oct, 2014 1 commit
-
-
wingo@igalia.com authored
BUG=v8:3534 LOG= R=svenpanne@chromium.org, wingo@igalia.com Review URL: https://codereview.chromium.org/614733002 Patch from Diego Pino <dpino@igalia.com>. git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 27 Mar, 2014 1 commit
-
-
svenpanne@chromium.org authored
R=jkummerow@chromium.org Review URL: https://codereview.chromium.org/214413006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20299 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 14 Nov, 2012 1 commit
-
-
yangguo@chromium.org authored
R=svenpanne@chromium.org BUG=v8:2397 Review URL: https://chromiumcodereview.appspot.com/11358214 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12956 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 31 May, 2011 1 commit
-
-
ager@chromium.org authored
Our testing infrastructure uses exceptions to indicate errors. assertUnreachable therefore throws an exception to indicate that it was reached. Therefore, it cannot be used to check that an exception was thrown using the pattern: try { shouldThrow(); assertUnreachable(); } catch(e) { } Such a test will always pass because assertUnreachable will throw an exception if shouldThrow does not. R=ricow@chromium.org Review URL: http://codereview.chromium.org/7053035 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8117 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 09 Jul, 2009 1 commit
-
-
lrn@chromium.org authored
Also changed a few other places that looked suspicious in the same way. Added more info to failing test case and rewrote incorrect uses of mjsunit "fail" function. Review URL: http://codereview.chromium.org/155279 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
- 21 Apr, 2009 2 commits
-
-
lrn@chromium.org authored
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-
lrn@chromium.org authored
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@1749 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
-