Comment #8 on issue 3087 by kaizhu256: ES6: Array.prototype.slice and
friends should use ToLength instead of ToUint32
https://code.google.com/p/v8/issues/detail?id=3087
+1
this is as serious bug, as it allows any website with this code to crash
the entire chrome browser.
it should b fixed before the issue becomes more well-known to hackers.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
