AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Throw when a holey property is set in Array.sort

Browse Source 
Do not allow that holey properties are defined in Array sort.
Throw a type error if the array is not extensible and there are holey
properties in the middle of the array.

BUG=v8:4888

Review-Url: https://codereview.chromium.org/2664173002
Cr-Commit-Position: refs/heads/master@{#43126}
This commit is contained in:
cwhan.tunz 2017-02-11 05:00:40 -08:00 committed by Commit bot
parent c9950faf47
commit 48dff523f7
3 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
AUTHORS
View File

@ -48,6 +48,7 @@ Bert Belder <bertbelder@gmail.com>
Burcu Dogan <burcujdogan@gmail.com>
Caitlin Potter <caitpotter88@gmail.com>
Craig Schlenter <craig.schlenter@gmail.com>
Choongwoo Han <cwhan.tunz@gmail.com>
Chris Nardi <hichris123@gmail.com>
Christopher A. Taylor <chris@gameclosure.com>
Daniel Andersson <kodandersson@gmail.com>
@ -64,7 +65,6 @@ Filipe David Manana <fdmanana@gmail.com>
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Geoffrey Garside <ggarside@gmail.com>
Gwang Yoon Hwang <ryumiel@company100.net>
Han Choongwoo <cwhan.tunz@gmail.com>
Henrique Ferreiro <henrique.ferreiro@gmail.com>
Hirofumi Mako <mkhrfm@gmail.com>
Honggyu Kim <honggyu.kp@gmail.com>

2
src/objects.cc
View File

@ -16894,7 +16894,7 @@ Handle<Object> JSObject::PrepareSlowElementsForSort(
Handle<Object> JSObject::PrepareElementsForSort(Handle<JSObject> object,
uint32_t limit) {
Isolate* isolate = object->GetIsolate();
if (object->HasSloppyArgumentsElements()) {
if (object->HasSloppyArgumentsElements() || !object->map()->is_extensible()) {
return handle(Smi::FromInt(-1), isolate);
}

23
test/mjsunit/array-sort.js
View File

@ -480,6 +480,29 @@ function TestSortOnProxy() {
}
TestSortOnProxy();
function TestSortOnNonExtensible() {
{
var arr = [1,,2];
Object.preventExtensions(arr);
assertThrows(() => arr.sort(), TypeError);
assertEquals(arr, [1,,2]);
}
{
var arr = [1,,undefined];
Object.preventExtensions(arr);
assertThrows(() => arr.sort(), TypeError);
assertFalse(arr.hasOwnProperty(1));
assertEquals(arr, [1,,undefined]);
}
{
var arr = [1,undefined,2];
Object.preventExtensions(arr);
arr.sort();
assertEquals(arr, [1,2,undefined]);
}
}
TestSortOnNonExtensible();
// Test special prototypes
(function testSortSpecialPrototypes() {