Reviewers: Yang,
Message:
Committed patchset #1 manually as r17974 (presubmit successful).
Description:
Fix previous backmerge (3.21.18.10 / r17958)
[email protected]
Committed: http://code.google.com/p/v8/source/detail?r=17974
Please review this at https://codereview.chromium.org/80753004/
SVN Base: https://v8.googlecode.com/svn/branches/3.21
Affected files (+4, -4 lines):
M src/typedarray.js
M src/version.cc
Index: src/typedarray.js
diff --git a/src/typedarray.js b/src/typedarray.js
index
e12230dd7186e6ab49a5a4a72b4bae2c46fed1fe..ec9849df699a3ac69b5e52492ec441446f05fc2b
100644
--- a/src/typedarray.js
+++ b/src/typedarray.js
@@ -69,6 +69,9 @@ function CreateTypedArrayConstructor(name, elementSize,
arrayId, constructor) {
function ConstructByLength(obj, length) {
var l = ToPositiveInteger(length, "invalid_typed_array_length");
+ if (l > %MaxSmi()) {
+ throw MakeRangeError("invalid_typed_array_length");
+ }
var byteLength = l * elementSize;
var buffer = new global.ArrayBuffer(byteLength);
%TypedArrayInitialize(obj, arrayId, buffer, 0, byteLength);
@@ -77,9 +80,6 @@ function CreateTypedArrayConstructor(name, elementSize,
arrayId, constructor) {
function ConstructByArrayLike(obj, arrayLike) {
var length = arrayLike.length;
var l = ToPositiveInteger(length, "invalid_typed_array_length");
- if (l > %MaxSmi()) {
- throw MakeRangeError("invalid_typed_array_length");
- }
if(!%TypedArrayInitializeFromArrayLike(obj, arrayId, arrayLike, l)) {
for (var i = 0; i < l; i++) {
obj[i] = arrayLike[i];
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
a6c290a48027c5048931c41831d5b26867d931fd..83109de104ef7f35e87c36e6b4d41ae618d57352
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 21
#define BUILD_NUMBER 18
-#define PATCH_LEVEL 11
+#define PATCH_LEVEL 12
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
