Comment #7 on issue 2379 by erights: Assigning to an out-of-bounds array
index when length is non-writable should be rejected
http://code.google.com/p/v8/issues/detail?id=2379
I believe the test case in #3 has since been fixed by changing the
way 'length' is implemented.
I understand that. What I'm asking is, given this change, do we expect that
it is now impossible for
Array.isArray(a) && a.length !==
Object.getOwnPropertyDescriptor(a, 'length').value
to be true by other means? In other words, how deeply do we believe the
change fixed the underlying problem? How confident should we be that at
least this invariant is now safe?
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
