[builtins] Fix OOB read/write using Array.from

Always use the runtime to set the length on an array if it doesn't match
the expected length after populating it using Array.from.

Bug: chromium:821137
Change-Id: I5a730db58de61ba789040e6dfc815d6067fbae64
Reviewed-on: https://chromium-review.googlesource.com/962222
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51919}
2 files changed
tree: 0b728ed5f0f905f1fc098d6c1d8de5d04a3ea80a
  1. benchmarks/
  2. build_overrides/
  3. docs/
  4. gni/
  5. include/
  6. infra/
  7. samples/
  8. src/
  9. test/
  10. testing/
  11. third_party/
  12. tools/
  13. .clang-format
  14. .editorconfig
  15. .git-blame-ignore-revs
  16. .gitignore
  17. .gn
  18. .vpython
  19. .ycm_extra_conf.py
  21. BUILD.gn
  22. ChangeLog
  24. codereview.settings
  25. DEPS
  27. LICENSE.fdlibm
  28. LICENSE.strongtalk
  29. LICENSE.v8
  30. LICENSE.valgrind
  31. OWNERS
  32. PRESUBMIT.py
  33. README.md
  34. snapshot_toolchain.gni

V8 JavaScript Engine

V8 is Google's open source JavaScript engine.

V8 implements ECMAScript as specified in ECMA-262.

V8 is written in C++ and is used in Google Chrome, the open source browser from Google.

V8 can run standalone, or can be embedded into any C++ application.

V8 Project page: https://github.com/v8/v8/wiki

Getting the Code

Checkout depot tools, and run

    fetch v8

This will checkout V8 into the directory v8 and fetch all of its dependencies. To stay up to date, run

    git pull origin
    gclient sync

For fetching all branches, add the following into your remote configuration in .git/config:

    fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
    fetch = +refs/tags/*:refs/tags/*


Please follow the instructions mentioned on the V8 wiki.