Reviewers: Yang,
Description:
Merged r17800, r17801 into 3.22 branch.
Limit the size for typed arrays to MaxSmi.
Limit size of dehoistable array indices
BUG=319722,chromium:319835,chromium:319860
[email protected]
Please review this at https://codereview.chromium.org/80643002/
SVN Base: https://v8.googlecode.com/svn/branches/3.22
Affected files (+127, -84 lines):
M src/d8.cc
M src/elements-kind.h
M src/elements-kind.cc
M src/hydrogen-dehoist.cc
M src/hydrogen-instructions.h
M src/lithium.h
M src/lithium.cc
M src/runtime.h
M src/runtime.cc
M src/typedarray.js
M src/version.cc
A + test/mjsunit/regress/regress-319722-ArrayBuffer.js
A + test/mjsunit/regress/regress-319722-TypedArrays.js
A + test/mjsunit/regress/regress-crbug-319835.js
A + test/mjsunit/regress/regress-crbug-319860.js
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
