AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Array.prototype.slice should only normalize result if it's an array

Browse Source 
R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2058013002
Cr-Commit-Position: refs/heads/master@{#36955}
This commit is contained in:
adamk 2016-06-14 02:37:53 -07:00 committed by Commit bot
parent 46020a2d12
commit 56ea2f9731
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/js/array.js
View File

@ -659,7 +659,7 @@ function ArraySlice(start, end) {
if (UseSparseVariant(array, len, IS_ARRAY(array), end_i - start_i)) {
%NormalizeElements(array);
%NormalizeElements(result);
if (IS_ARRAY(result)) %NormalizeElements(result);
SparseSlice(array, start_i, end_i - start_i, len, result);
} else {
SimpleSlice(array, start_i, end_i - start_i, len, result);

8
test/mjsunit/regress/regress-crbug-618788.js Normal file
View File

@ -0,0 +1,8 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertThrows(() => a.slice());