2 Commits

Author	SHA1	Message	Date
Marja Hölttä	47aaddc508	[rab/gsab] Now really fix the destination being resizable in TA.p.slice ... Cancel the unnecessary fix https://chromium-review.googlesource.com/c/v8/v8/+/4028559 and fix the problem at its root, TypedArraySpeciesCreateByLength. This fix also fixes other variants of this bug (see tests). Drive by: harden by setting length = 0 (not only byte_length) for length tracking TAs. Bug: v8:11111,chromium:1384474 Change-Id: I3ba660f7f600c0b946c75e7f13276703394c7df2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4030259 Auto-Submit: Marja Hölttä <marja@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#84312}	2022-11-16 21:38:50 +00:00
Marja Hölttä	ad46317053	[rab/gsab] Fix the destination being resizable in TA.p.slice ... Bug: v8:11111,chromium:1384474 Change-Id: I4a8e272a95992244e3871ca826a65f542335fb13 Fixed: chromium:1384474 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4028559 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#84280}	2022-11-16 08:22:27 +00:00