http://codereview.chromium.org/293023/diff/1043/58
File src/runtime.cc (right):

http://codereview.chromium.org/293023/diff/1043/58#newcode2583
Line 2583: // If the target object is a JSObject and has an
ExternalArray as
What happens if you get -1 represented as a heap number?  There's no
guarantee that integers in smi range will be represented as smis.

http://codereview.chromium.org/293023

--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---

Reply via email to