Updates:
Owner: [email protected]
Comment #14 on issue 3087 by [email protected]: ES6:
Array.prototype.slice and friends should use ToLength instead of ToUint32
https://code.google.com/p/v8/issues/detail?id=3087
I'll put this on my list, since I'm handling other Array/TypedArray stuff,
unless someone else wnats it.
To "v8.team.admin": This could be rather expensive to develop behind a
flag. Then we'd have to check that flag on all array operations, whereas
TO_UINT32 makes a strong effort to be efficient. While this wasn't a bug
when V8 was implementing ES5.1, I think we're going for ES6 compliance now,
so we should either fix this or (if it breaks the web) get it reverted for
ES7. It's certainly not a security issue, however.
To me, it's a big open question whether this breaks the web. There's this
Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1064000 . That
seems to imply that they haven't gotten started on this for any of the
Array methods. No idea why someone would use a negative length though.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
