Benedikt Meurer fd150c7988 [turbofan] Generate the correct bounds when the array protector isn't valid. ... The condition for bounds check generation was not in sync with the condition that was used for the actual access, which lead to invalid memory accesses when the array protector was invalid. Tbr: tebbi@chromium.org Bug: chromium:781506, chromium:781494, chromium:781457, chromium:781285, chromium:781381, chromium:781380, v8:6936, v8:7014, v8:7027 Change-Id: Ia5b2ad02940292572ed9b37abd3f9ffaa6d7a26b Reviewed-on: https://chromium-review.googlesource.com/753590 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#49124}		2017-11-04 12:06:31 +00:00
..
benchmarks	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
cctest	[Memory] Clean up base OS memory abstractions.	2017-11-03 18:49:55 +00:00
common	[wasm] Support block parameters	2017-10-24 11:44:26 +00:00
debugger	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
fuzzer	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
inspector	[inspector] added Debugger.setReturnValue	2017-11-04 00:38:09 +00:00
intl	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
js-perf-test	[parser] Use n-ary addition for template strings	2017-10-31 16:02:53 +00:00
memory	[snapshot] add tracking for builtin snapshot size.	2017-08-31 07:29:31 +00:00
message	[test/message] Allow numbers to have more than one leading digit.	2017-11-03 15:25:25 +00:00
mjsunit	[turbofan] Generate the correct bounds when the array protector isn't valid.	2017-11-04 12:06:31 +00:00
mkgrokdump	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
mozilla	[d8] Report errors in setTimeout	2017-11-03 12:21:53 +00:00
preparser	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
promises-aplus	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
test262	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
unittests	Revert "[bits] Consolidate Count{Leading,Trailing}Zeros"	2017-11-04 09:34:11 +00:00
wasm-spec-tests	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
webkit	[test] Let flags from test case have precedence	2017-10-27 13:22:39 +00:00
bot_default.gyp	[wasm] Add wasm spec tests to the v8 test runner	2017-04-27 13:00:13 +00:00
bot_default.isolate	[wasm] Add wasm spec tests to the v8 test runner	2017-04-27 13:00:13 +00:00
BUILD.gn	[wasm] Remove the wasm-asmjs fuzzer	2017-06-21 10:59:35 +00:00
default.gyp	[wasm] Add wasm spec tests to the v8 test runner	2017-04-27 13:00:13 +00:00
default.isolate	[wasm] Add wasm spec tests to the v8 test runner	2017-04-27 13:00:13 +00:00
optimize_for_size.gyp
optimize_for_size.isolate	[debugger] basic test infrastructure for new debugger test api.	2016-10-21 06:38:05 +00:00
perf.gyp
perf.isolate	Remove SIMD.js from V8.	2017-02-14 06:57:25 +00:00