Fix another corner case for DefineOwnProperty on arrays.
R=rossberg@chromium.org BUG=v8:1756 TEST=test262 Review URL: http://codereview.chromium.org/8890015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
parent
7348d910f2
commit
4dd5bb2892
@ -873,27 +873,31 @@ function DefineArrayProperty(obj, p, desc, should_throw) {
|
||||
throw new $RangeError('defineProperty() array length out of range');
|
||||
}
|
||||
var length_desc = GetOwnProperty(obj, "length");
|
||||
// Make sure the below call to DefineObjectProperty() doesn't overwrite
|
||||
// any magic "length" property by removing the value.
|
||||
desc.value_ = void 0;
|
||||
desc.hasValue_ = false;
|
||||
if ((new_length != length && !length_desc.isWritable()) ||
|
||||
!DefineObjectProperty(obj, "length", desc, should_throw)) {
|
||||
if (new_length != length && !length_desc.isWritable()) {
|
||||
if (should_throw) {
|
||||
throw MakeTypeError("redefine_disallowed", [p]);
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
obj.length = new_length;
|
||||
var threw = false;
|
||||
while (new_length < length--) {
|
||||
if (!Delete(obj, length, false)) {
|
||||
obj.length = length + 1;
|
||||
if (should_throw) {
|
||||
throw MakeTypeError("redefine_disallowed", [p]);
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
if (!Delete(obj, ToString(length), false)) {
|
||||
new_length = length + 1;
|
||||
threw = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
// Make sure the below call to DefineObjectProperty() doesn't overwrite
|
||||
// any magic "length" property by removing the value.
|
||||
obj.length = new_length;
|
||||
desc.value_ = void 0;
|
||||
desc.hasValue_ = false;
|
||||
if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw) {
|
||||
if (should_throw) {
|
||||
throw MakeTypeError("redefine_disallowed", [p]);
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
|
@ -43,13 +43,12 @@ S10.4.2.1_A1: FAIL
|
||||
S15.3.3.1_A4: FAIL
|
||||
|
||||
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1756
|
||||
15.2.3.6-4-167: FAIL
|
||||
15.2.3.6-4-168: FAIL
|
||||
15.2.3.6-4-181: FAIL
|
||||
15.2.3.7-6-a-163: FAIL
|
||||
15.2.3.7-6-a-164: FAIL
|
||||
15.2.3.6-4-167: FAIL || PASS
|
||||
15.2.3.6-4-181: FAIL || PASS
|
||||
15.2.3.7-6-a-163: FAIL || PASS
|
||||
15.2.3.7-6-a-164: FAIL || PASS
|
||||
15.2.3.7-6-a-176: FAIL || PASS
|
||||
15.2.3.7-6-a-177: FAIL
|
||||
15.2.3.7-6-a-177: FAIL || PASS
|
||||
|
||||
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1772
|
||||
15.2.3.6-4-292-1: FAIL
|
||||
|
Loading…
Reference in New Issue
Block a user