src/arm · b6e2763768d770cee27756d890c735399298e580 · Linshizhi / V8

Out of bounds memory access in TestJSArrayForAllocationSiteInfo. · d7d917e6

mvstanton@chromium.org authored Jan 21, 2013

The function intended to check the map pointer of an AllocationSiteInfo object, but neglected to
subtract an offset to do so.

BUG=169928

Review URL: https://codereview.chromium.org/11931037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

d7d917e6

Name	Last commit	Last update
..
assembler-arm-inl.h		Loading commit data...
assembler-arm.cc		Loading commit data...
assembler-arm.h		Loading commit data...
builtins-arm.cc		Loading commit data...
code-stubs-arm.cc		Loading commit data...
code-stubs-arm.h		Loading commit data...
codegen-arm.cc		Loading commit data...
codegen-arm.h		Loading commit data...
constants-arm.cc		Loading commit data...
constants-arm.h		Loading commit data...
cpu-arm.cc		Loading commit data...
debug-arm.cc		Loading commit data...
deoptimizer-arm.cc		Loading commit data...
disasm-arm.cc		Loading commit data...
frames-arm.cc		Loading commit data...
frames-arm.h		Loading commit data...
full-codegen-arm.cc		Loading commit data...
ic-arm.cc		Loading commit data...
lithium-arm.cc		Loading commit data...
lithium-arm.h		Loading commit data...
lithium-codegen-arm.cc		Loading commit data...
lithium-codegen-arm.h		Loading commit data...
lithium-gap-resolver-arm.cc		Loading commit data...
lithium-gap-resolver-arm.h		Loading commit data...
macro-assembler-arm.cc		Loading commit data...
macro-assembler-arm.h		Loading commit data...
regexp-macro-assembler-arm.cc		Loading commit data...
regexp-macro-assembler-arm.h		Loading commit data...
simulator-arm.cc		Loading commit data...
simulator-arm.h		Loading commit data...
stub-cache-arm.cc		Loading commit data...