Mike Stanton 2222a9d67e [Builtins] Array.prototype.reduce missing length check ... In the recent port of reduce() and reduceRight(), a check for a length change during the loop (standard for iterating builtins) was omitted. We did get array bounds check protection, however it didn't expose the issue in our tests because the bounds check is against the backing store length, not against the length in the referring JSArray. Also added a test for reduceRight(). R=jgruber@chromium.org Bug: chromium:937676 Change-Id: I76e22e0d71965bff84a0822b1df5dc818a00b50e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1503732 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#60033}		2019-03-05 14:58:59 +00:00
..
benchmarks	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
cctest	PPC/s390: [arm][turbofan] Implement on-stack returns.	2019-03-05 14:51:10 +00:00
common	Reland "[wasm] add wasm atomic wait callback test"	2019-02-20 05:17:07 +00:00
debugger	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
fuzzer	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
inspector	[modules] Make debug-scopes handle synthetic variables	2019-03-04 15:06:02 +00:00
intl	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
js-perf-test	[js-perf-test] Add TypedArray#filter micro-benchmark	2019-03-04 14:40:31 +00:00
memory	[snapshot] Remove the builtins snapshot	2018-10-31 10:18:28 +00:00
message	[fni] Mark computed props as computed, not anonymous function	2019-03-01 20:52:03 +00:00
mjsunit	[Builtins] Array.prototype.reduce missing length check	2019-03-05 14:58:59 +00:00
mkgrokdump	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
mozilla	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
preparser	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
test262	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
torque	[torque] Simplify class and struct construction	2019-02-27 17:36:37 +00:00
unittests	[heap] Decouple the max semi-space size from the page size	2019-03-05 12:12:20 +00:00
wasm-js	[testrunner] handle timeout param in file	2019-02-27 17:49:17 +00:00
wasm-spec-tests	[wasm] Update spec tests	2019-02-27 10:42:02 +00:00
webkit	[test] Don't test jitless without embedded-builtins	2019-02-26 14:33:01 +00:00
BUILD.gn	Add target for common test headers	2019-02-12 09:30:01 +00:00
OWNERS	Make tmrts an infra OWNER	2019-02-15 09:02:24 +00:00