Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(107)

Issue 1424823005: Reland of Check that array length stays a safe integer in Array.prototype.push (Closed)

Created:
5 years, 1 month ago by Dan Ehrenberg
Modified:
5 years, 1 month ago
Reviewers:
adamk
CC:
v8-reviews_googlegroups.com
Base URL:
https://chromium.googlesource.com/v8/v8.git@master
Target Ref:
refs/pending/heads/master
Project:
v8
Visibility:
Public.

Description

Reland of Check that array length stays a safe integer in Array.prototype.push (patchset #1 id:1 of https://codereview.chromium.org/1418093007/ ) Reason for revert: The test failure was unrelated; relanding. Original issue's description: > Revert of Check that array length stays a safe integer in Array.prototype.push (patchset #7 id:120001 of https://codereview.chromium.org/1428483002/ ) > > Reason for revert: > Caused for-in-opt test to fail > > Original issue's description: > > Check that array length stays a safe integer in Array.prototype.push > > > > This patch adds a check in Array.prototype.push to assert that the new > > length does not become greater than 2**53-1. Such a length would be > > dangerous because integer arithmetic becomes imprecise after the > > boundary. The check is also required by a test262 test. > > > > R=adamk > > LOG=Y > > BUG=v8:3087 > > > > Committed: https://crrev.com/e68adf4548dd101dc08fcbff14444152fb1b7fe7 > > Cr-Commit-Position: refs/heads/master@{#31588} > > TBR=adamk@chromium.org > NOPRESUBMIT=true > NOTREECHECKS=true > NOTRY=true > BUG=v8:3087 > > Committed: https://crrev.com/78abedb94431a233842fcb2f7a910805a05bed09 > Cr-Commit-Position: refs/heads/master@{#31590} TBR=adamk@chromium.org NOPRESUBMIT=true NOTREECHECKS=true NOTRY=true BUG=v8:3087 Committed: https://crrev.com/8adb1c4705dc836fe1aa061511376c65e59e6a55 Cr-Commit-Position: refs/heads/master@{#31610}

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+13 lines, -7 lines) Patch
M src/js/array.js View 1 chunk +9 lines, -0 lines 0 comments Download
M src/messages.h View 1 chunk +3 lines, -0 lines 0 comments Download
M test/mjsunit/harmony/array-length.js View 1 chunk +1 line, -7 lines 0 comments Download

Messages

Total messages: 4 (0 generated)
Dan Ehrenberg
Created Reland of Check that array length stays a safe integer in Array.prototype.push
5 years, 1 month ago (2015-10-27 16:30:06 UTC) #1
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1424823005/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1424823005/1
5 years, 1 month ago (2015-10-27 16:30:19 UTC) #2
commit-bot: I haz the power
Committed patchset #1 (id:1)
5 years, 1 month ago (2015-10-27 16:30:29 UTC) #3
commit-bot: I haz the power
5 years, 1 month ago (2015-10-27 16:30:58 UTC) #4
Message was sent while issue was closed.
Patchset 1 (id:??) landed as
https://crrev.com/8adb1c4705dc836fe1aa061511376c65e59e6a55
Cr-Commit-Position: refs/heads/master@{#31610}

Powered by Google App Engine
This is Rietveld 408576698