3 Commits

Author	SHA1	Message	Date
jkummerow	087ae1b08a	Fix off-by-one in Array.concat's max index check ... The maximum valid index is strictly smaller than the maximum valid length. BUG=chromium:516592 LOG=y R=yangguo@chromium.org Review URL: https://codereview.chromium.org/1278703003 Cr-Commit-Position: refs/heads/master@{#30040}	2015-08-06 09:57:19 +00:00
verwaest	2fb894fa58	Use GetProperty for getting elements. ... This also fixes issues with - kMaxUint32 being a valid length but not index cornercases - exotic integer objects masking "exotic indexes" even though its in the prototype chain - concating of holey sloppy arguments BUG=v8:4137 LOG=n Review URL: https://codereview.chromium.org/1159433003 Cr-Commit-Position: refs/heads/master@{#28754}	2015-06-02 10:42:29 +00:00
yangguo@chromium.org	e33b68817b	Fix Array.prototype.concat when exceeding array size limit. ... R=verwaest@chromium.org BUG=v8:581 Review URL: https://chromiumcodereview.appspot.com/13465008 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14154 ce2b1a6d-e550-0410-aec6-3dcde31c8c00	2013-04-05 15:12:59 +00:00