v8/third_party
Jakob Gruber 1444bebe76 [array] Weaken bounds checks in Array.p.sort
The array length is modifiable by user code that is called as a
side-effect during the sorting algorithm. We thus cannot base any
guarantees on the current length, but must reference the initially-read
array length instead.

Note that even though the algorithm may read and write from beyond
the current array length value, this adheres to the spec, which only
requires accesses to be within the original array dimensions (i.e.: 0
<= i < original array length).

Bug: chromium:901633
Change-Id: Id765e80d4231ff6f2a73e040ec94c2b07f8c5b0f
Reviewed-on: https://chromium-review.googlesource.com/c/1317814
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57279}
2018-11-06 14:04:38 +00:00
..
binutils Update binutils to 2.30 2018-09-26 07:36:07 +00:00
colorama Add colorama package to DEPS so that pylib can import it 2017-10-24 14:18:49 +00:00
eu-strip [build] Port "Add patched eu-strip in third_party" 2017-09-25 09:52:23 +00:00
googletest Update V8 DEPS. 2018-10-25 07:28:05 +00:00
inspector_protocol Roll inspector_protocol to 460186cff1f0eead0d418626e7e75f52105182b2. 2018-10-24 01:05:53 +00:00
v8/builtins [array] Weaken bounds checks in Array.p.sort 2018-11-06 14:04:38 +00:00