From 75c388e691e80e5a4639061aeda5fc11b36e00db Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Fri, 12 Apr 2013 08:45:14 +0000 Subject: [PATCH] Fix detection of indexed properties in Object.defineProperty() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When defining an indexed property on an Array object, the object's length property should (perhaps) be updated. This was done for any property for which ToUInt32(name) == ToNumber(name) was true, meaning any property name that, when converted to a number, was an integer in the range [0, 2^32). The detection should be more strict; an indexed property is one for which ToString(ToUInt32(name)) == name is true only. Review URL: https://codereview.chromium.org/13914003 Patch from Jens Lindström . git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14242 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/v8natives.js | 2 +- test/mjsunit/object-define-property.js | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/v8natives.js b/src/v8natives.js index 76d37fa2ae..83b561859a 100644 --- a/src/v8natives.js +++ b/src/v8natives.js @@ -932,7 +932,7 @@ function DefineArrayProperty(obj, p, desc, should_throw) { // Step 4 - Special handling for array index. var index = ToUint32(p); - if (index == ToNumber(p) && index != 4294967295) { + if (ToString(index) == p && index != 4294967295) { var length = obj.length; var length_desc = GetOwnProperty(obj, "length"); if ((index >= length && !length_desc.isWritable()) || diff --git a/test/mjsunit/object-define-property.js b/test/mjsunit/object-define-property.js index 970a803349..835d0e0a55 100644 --- a/test/mjsunit/object-define-property.js +++ b/test/mjsunit/object-define-property.js @@ -918,6 +918,11 @@ assertFalse(desc.writable); assertFalse(desc.enumerable); assertFalse(desc.configurable); +// Define non-array property, check that .length is unaffected. +assertEquals(16, arr.length); +Object.defineProperty(arr, '0x20', descElement); +assertEquals(16, arr.length); + // See issue 968: http://code.google.com/p/v8/issues/detail?id=968 var o = { x : 42 }; Object.defineProperty(o, "x", { writable: false });