| 16:42 | <hsivonen> | Where does the ECMAScript spec say what the valid range for String and ArrayBuffer .length property is? |
| 16:43 | <hsivonen> | ah. 6.1.4 |
| 16:43 | <hsivonen> | Does V8 or JSC actually allow strings whose length doesn't fit in uint32_t? |
| 16:44 | <gsnedders> | I don't think V8 does, at least. |
| 16:44 | <gsnedders> | Because the heap limit is smaller than that. |
| 17:00 | <hsivonen> | ok. I guess strings longer 32-bit length are theoretical |
| 17:01 | <hsivonen> | it'll be fun to see what breaks when actually trying to go past the limit in the future |
| 17:01 | <hsivonen> | but I guess it's technically correct to use WebIDL unsigned long long for values that might have to hold string max length |
| 17:01 | <hsivonen> | in theory at least |
| 23:07 | <TabAtkins> | Jeezus, I'm incapable of wording right now. What's the term for a site that holds a lot of libraries people might want to load, so you can just load scripts from there rather than loading them from your own server? |
| 23:12 | <MikeSmith> | TabAtkins: CDN? |
| 23:13 | <TabAtkins> | THANK YOU, yes, that's it |
| 23:13 | <MikeSmith> | cheers :) |
| 23:13 | <astearns> | (I was going to go with a Single Point Vulnerability) |