AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Array.prototype.{reduce, reduceRight}: Wrong order of operations when determining initial value.

Browse Source 
BUG=v8:3534
LOG=
R=svenpanne@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/614733002

Patch from Diego Pino <dpino@igalia.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24807 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
wingo@igalia.com 2014-10-22 13:13:19 +00:00
parent 5680786c21
commit 6c9bab5c74
2 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/array.js
View File

@ -1418,9 +1418,8 @@ function ArrayReduce(callback, current) {
var i = 0;
find_initial: if (%_ArgumentsLength() < 2) {
for (; i < length; i++) {
current = array[i];
if (!IS_UNDEFINED(current) || i in array) {
i++;
if (i in array) {
current = array[i++];
break find_initial;
}
}
@ -1455,9 +1454,8 @@ function ArrayReduceRight(callback, current) {
var i = length - 1;
find_initial: if (%_ArgumentsLength() < 2) {
for (; i >= 0; i--) {
current = array[i];
if (!IS_UNDEFINED(current) || i in array) {
i--;
if (i in array) {
current = array[i--];
break find_initial;
}
}

10
test/mjsunit/array-reduce.js
View File

@ -521,3 +521,13 @@ testReduce("reduce", "ArrayManipulationExtender", 10,
[3, 3, 2, [1, 2, 3, 4, 4, 5], 6],
[6, 4, 3, [1, 2, 3, 4, 4, 5, 6], 10],
], arr, extender, 0);
var arr = [];
Object.defineProperty(arr, "0", { get: function() { delete this[0] },
configurable: true });
assertEquals(undefined, arr.reduce(function(val) { return val }));
var arr = [];
Object.defineProperty(arr, "0", { get: function() { delete this[0] },
configurable: true});
assertEquals(undefined, arr.reduceRight(function(val) { return val }));