Updates:
Owner: [email protected]
Cc: [email protected]
Comment #3 on issue 3520 by [email protected]: Chrome JS on MacOSX array
push bug, pushing NaN sometimes results in INT MIN being pushed leading to
erratic client code behavior.
http://code.google.com/p/v8/issues/detail?id=3520
Interestingly, this has been introduced by a back merge to V8 3.26
Author: [email protected]
<[email protected]@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu Jul 31 08:54:45 2014 +0000
Version 3.26.31.12 (merged r22616, r22617)
In GrowMode, force the value to the right representation to avoid
deopts between storing the length and storing the value.
Smi arrays are only guaranteed to be initialized in non-holey case
BUG=16459193
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/430103002
git-svn-id: https://v8.googlecode.com/svn/branches/3.26@22739
ce2b1a6d-e550-0410-aec6-3dcde31c8c00
Toon, is this back merge incomplete or did the patch apply wrong? Or does
this have an underlying issue that's not yet fixed?
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
