6018d479b6
A single ClusterFuzz report flushed out two minor issues in the bit fiddling routines. Bug: chromium:1227752,v8:11515 Change-Id: I16ab914b7c3859f55aa141ced371dd80171d0cb5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3017809 Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75678} |
||
|---|---|---|
| .. | ||
| add.js | ||
| and.js | ||
| as-int-n.js | ||
| basics.js | ||
| comparisons.js | ||
| dataview.js | ||
| dec.js | ||
| div.js | ||
| exp.js | ||
| inc.js | ||
| json.js | ||
| misc.js | ||
| mod-special-cases.js | ||
| mod.js | ||
| mul-special-cases.js | ||
| mul.js | ||
| neg.js | ||
| not.js | ||
| or.js | ||
| property-names.js | ||
| regress-fftmul.js | ||
| regress-tonumbercode.js | ||
| regressions.js | ||
| rematerialize-on-deopt.js | ||
| sar.js | ||
| shl.js | ||
| sub.js | ||
| tonumber.js | ||
| turbo.js | ||
| typedarray.js | ||
| xor.js | ||