Regression test uploaded
https://chromiumcodereview.appspot.com/10532193/diff/6001/src/array.js File src/array.js (right): https://chromiumcodereview.appspot.com/10532193/diff/6001/src/array.js#newcode781 src/array.js:781: var t_array = []; On 2012/06/19 14:52:17, danno wrote:
How about creating an InternalArray of the appropriate size here? That
obviates
the need for the push() stub call later (you can just assign to the
element) OK I tried that and it ended badly. I have to be 100% sure I get the length right and there are multiple chances to make off by 1 errors. Leaving as it is unless you feel very strongly about this. https://chromiumcodereview.appspot.com/10532193/diff/6001/src/array.js#newcode802 src/array.js:802: third_index = GetThirdIndex(a, from, to); On 2012/06/19 14:52:17, danno wrote:
It still seems to be the case that you can carefully construct an
array that
triggers the worst case. Is that something we need to avoid?
I think we don't as long as it can't happen accidentally. There is no longer a stack overflow risk. https://chromiumcodereview.appspot.com/10532193/ -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
