https://codereview.chromium.org/1195823002/diff/60001/src/accessors.cc
File src/accessors.cc (right):
https://codereview.chromium.org/1195823002/diff/60001/src/accessors.cc#newcode205
src/accessors.cc:205: return wrapper->value()->ToArrayIndex(length);
On 2015/06/19 20:48:57, Toon Verwaest wrote:
I think this is actually wrong...
Number.prototype.valueOf = function() { return 100; }
a = [];
a.length = new Number(10)
should probably result in an array of size 100, not 10 as it does
right now.
Good point, in addition to checking the wrapper's map for being
pristine, we also need to check its prototype.
https://codereview.chromium.org/1195823002/
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
