Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(289)

Issue 9968056: Properly support shrinking arrays in CopyDictionaryToObjectElements. (Closed)

Created:
8 years, 8 months ago by danno
Modified:
8 years, 8 months ago
Reviewers:
Michael Starzinger
CC:
v8-dev
Visibility:
Public.

Description

Properly support shrinking arrays in CopyDictionaryToObjectElements. R=mstarzinger@chromium.org BUG=chromium:121407 TEST=test/mjsunit/regress/regress-121407.js Committed: https://code.google.com/p/v8/source/detail?r=11214

Patch Set 1 #

Patch Set 2 : Remove assert #

Patch Set 3 : Extend test case #

Total comments: 1
Unified diffs Side-by-side diffs Delta from patch set Stats (+48 lines, -2 lines) Patch
M src/elements.cc View 1 2 chunks +8 lines, -2 lines 1 comment Download
A test/mjsunit/regress/regress-121407.js View 1 2 1 chunk +40 lines, -0 lines 0 comments Download

Messages

Total messages: 1 (0 generated)
Michael Starzinger
8 years, 8 months ago (2012-04-03 08:13:18 UTC) #1
LGTM.

https://chromiumcodereview.appspot.com/9968056/diff/2002/src/elements.cc
File src/elements.cc (right):

https://chromiumcodereview.appspot.com/9968056/diff/2002/src/elements.cc#newc...
src/elements.cc:206: if (to_start + copy_size > to_length) {
I suspect that without the cast this will lead to warnings on VSC++. But I am
unsure, so I would just let it run through the buildbots.

Powered by Google App Engine
This is Rietveld 408576698