Updates:
Status: WorkingAsIntended
Comment #1 on issue 2712 by yang...@chromium.org: slice hangs
http://code.google.com/p/v8/issues/detail?id=2712
Unfortunately, the spec is pretty precise about this:
15.4.4.10 Array.prototype.slice(start, end)
[...]
1. Let O be the result of calling ToObject passing the this value as the
argument.
2. Let A be a new array created as if by the expression new Array() where
Array is the standard built-in
constructor with that name.
3. Let lenVal be the result of calling the [[Get]] internal method of O
with argument "length ".
4. Let len be ToUint32(lenVal).
-1 is turned into 2^32-1 at step 4. That's just JavaScript for you...
Personally, I don't think this is a big issue.
[].slice.call({length: 4294967295}, 0); has the same effect, or just a
for(;;);
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
