Comment #3 on issue 4218 by [email protected]: ToLength called
multiple times in %TypedArray%.prototype.set
https://code.google.com/p/v8/issues/detail?id=4218#c3
The following revision refers to this bug:
https://chromium.googlesource.com/v8/v8.git/+/df999c9790e96a72a6c56e67182a144b0e718591
commit df999c9790e96a72a6c56e67182a144b0e718591
Author: ejcaruso <[email protected]>
Date: Wed Aug 19 01:32:56 2015
Only evaluate length once in %TypedArray%.prototype.set
The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.
[email protected]
LOG=N
BUG=v8:4218
Review URL: https://codereview.chromium.org/1237583005
Cr-Commit-Position: refs/heads/master@{#30240}
[modify]
http://crrev.com/df999c9790e96a72a6c56e67182a144b0e718591/src/typedarray.js
[add]
http://crrev.com/df999c9790e96a72a6c56e67182a144b0e718591/test/mjsunit/es6/typedarray-set-length.js
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
