Ubuntu
chromium-browser package

  1. Bug #1004795
  2. Comment #9

Comment 9 for bug 1004795

Revision history for this message
Jeremy Bícha (jbicha) wrote :

This bug was fixed in the package libv8 - 3.8.9.20-2
Sponsored for Logan Rosen (logan)

---------------
libv8 (3.8.9.20-2) unstable; urgency=low

  * Cherry-picked four upstream patches from 3.8.9.29:
    + r11654.patch: fix CVE-2011-3111, closes:bug#687574.
    + r12161.patch: Fix ICs for slow objects with native accessor.
    + r12336.patch: Fix bug in compare IC.
    + r12460.patch: Fix some corner cases in skipping native methods
                    using caller. Fix binding in new Function().

 -- Jérémy Lal <email address hidden> Sat, 29 Sep 2012 01:04:06 +0200