AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix detection of indexed properties in Object.defineProperty()

Browse Source 
When defining an indexed property on an Array object, the object's
length property should (perhaps) be updated.  This was done for any
property for which

  ToUInt32(name) == ToNumber(name)

was true, meaning any property name that, when converted to a number,
was an integer in the range [0, 2^32).  The detection should be more
strict; an indexed property is one for which

  ToString(ToUInt32(name)) == name

is true only.

Review URL: https://codereview.chromium.org/13914003

Patch from Jens Lindström <jl@opera.com>.

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2013-04-12 08:45:14 +00:00
parent 66f5c75dab
commit 75c388e691
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/v8natives.js
View File

@ -932,7 +932,7 @@ function DefineArrayProperty(obj, p, desc, should_throw) {
// Step 4 - Special handling for array index.
var index = ToUint32(p);
if (index == ToNumber(p) && index != 4294967295) {
if (ToString(index) == p && index != 4294967295) {
var length = obj.length;
var length_desc = GetOwnProperty(obj, "length");
if ((index >= length && !length_desc.isWritable()) ||

5
test/mjsunit/object-define-property.js
View File

@ -918,6 +918,11 @@ assertFalse(desc.writable);
assertFalse(desc.enumerable);
assertFalse(desc.configurable);
// Define non-array property, check that .length is unaffected.
assertEquals(16, arr.length);
Object.defineProperty(arr, '0x20', descElement);
assertEquals(16, arr.length);
// See issue 968: http://code.google.com/p/v8/issues/detail?id=968
var o = { x : 42 };
Object.defineProperty(o, "x", { writable: false });