AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Set length only after retrieving the element succeeded

Browse Source 
Review URL: https://chromiumcodereview.appspot.com/11417006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
verwaest@chromium.org 2012-11-15 14:30:01 +00:00
parent 111630350c
commit 8535c6484d
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/builtins.cc
View File

@ -673,14 +673,17 @@ BUILTIN(ArrayPop) {
ElementsAccessor* accessor = array->GetElementsAccessor();
int new_length = len - 1;
Object* result;
MaybeObject* maybe_result = accessor->Get(array, array, new_length);
if (!maybe_result->To(&result)) return maybe_result;
MaybeObject* maybe_result;
if (accessor->HasElement(array, array, new_length, elms_obj)) {
maybe_result = accessor->Get(array, array, new_length, elms_obj);
} else {
maybe_result = array->GetPrototype()->GetElement(len - 1);
}
if (maybe_result->IsFailure()) return maybe_result;
MaybeObject* maybe_failure =
accessor->SetLength(array, Smi::FromInt(new_length));
if (maybe_failure->IsFailure()) return maybe_failure;
if (!result->IsTheHole()) return result;
return array->GetPrototype()->GetElement(len - 1);
return maybe_result;
}