Reviewers: Lasse Reichstein,
Description:
Add array bound checks to code generated for SwapElements. This fixes a bug
that
lead to a segfault when an array was modified while it was sorted.
Please review this at http://codereview.chromium.org/5686006/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/
Affected files:
M src/arm/codegen-arm.cc
M src/ia32/codegen-ia32.cc
M src/ia32/full-codegen-ia32.cc
M src/x64/codegen-x64.cc
test/mjsunit/regress/regress-swapelements.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
