DescriptionOnly evaluate length once in %TypedArray%.prototype.set
The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.
R=littledan@chromium.org
LOG=N
BUG=v8:4218
Committed: https://crrev.com/df999c9790e96a72a6c56e67182a144b0e718591
Cr-Commit-Position: refs/heads/master@{#30240}
Patch Set 1 #
Total comments: 1
Patch Set 2 : Add sanity check #Patch Set 3 : Add more cases to the test #
Messages
Total messages: 11 (3 generated)
|