tree 0b728ed5f0f905f1fc098d6c1d8de5d04a3ea80a
parent 1dab065bb4025bdd663ba12e2e976c34c3fa6599
author Dan Elphick <delphick@chromium.org> 1521021728 +0000
committer Commit Bot <commit-bot@chromium.org> 1521027102 +0000

[builtins] Fix OOB read/write using Array.from

Always use the runtime to set the length on an array if it doesn't match
the expected length after populating it using Array.from.

Bug: chromium:821137
Change-Id: I5a730db58de61ba789040e6dfc815d6067fbae64
Reviewed-on: https://chromium-review.googlesource.com/962222
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51919}