diff --git a/src/elements.cc b/src/elements.cc index c9d6276a5e..74d6ebbce7 100644 --- a/src/elements.cc +++ b/src/elements.cc @@ -1436,7 +1436,9 @@ class FastElementsAccessor : public ElementsAccessorBase { } if (entry == 0) { FixedArray* empty = heap->empty_fixed_array(); - if (Subclass::kind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) { + // Dynamically ask for the elements kind here since we manually redirect + // the operations for argument backing stores. + if (obj->GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) { FixedArray::cast(obj->elements())->set(1, empty); } else { obj->set_elements(empty); @@ -2356,7 +2358,7 @@ class SloppyArgumentsElementsAccessor FixedArray* arguments = FixedArray::cast(parameter_map->get(1)); uint32_t entry = ArgumentsAccessor::GetEntryForIndexImpl(holder, arguments, index, filter); - if (entry == kMaxUInt32) return entry; + if (entry == kMaxUInt32) return kMaxUInt32; return (parameter_map->length() - 2) + entry; } diff --git a/test/mjsunit/arguments.js b/test/mjsunit/arguments.js index 26eb38912a..97ec7cca6d 100644 --- a/test/mjsunit/arguments.js +++ b/test/mjsunit/arguments.js @@ -204,3 +204,70 @@ assertEquals(117, arg_set(0xFFFFFFFF)); } assertTrue(%HasSloppyArgumentsElements(a)); })(); + +(function testDeleteArguments() { + function f() { return arguments }; + var args = f(1, 2); + assertEquals(1, args[0]); + assertEquals(2, args[1]); + assertEquals(2, args.length); + + delete args[0]; + assertEquals(undefined, args[0]); + assertEquals(2, args[1]); + assertEquals(2, args.length); + + delete args[1]; + assertEquals(undefined, args[0]); + assertEquals(undefined, args[1]); + assertEquals(2, args.length); +})(); + +(function testDeleteFastSloppyArguments() { + function f(a) { return arguments }; + var args = f(1, 2); + assertEquals(1, args[0]); + assertEquals(2, args[1]); + assertEquals(2, args.length); + + delete args[0]; + assertEquals(undefined, args[0]); + assertEquals(2, args[1]); + assertEquals(2, args.length); + + delete args[1]; + assertEquals(undefined, args[0]); + assertEquals(undefined, args[1]); + assertEquals(2, args.length); +})(); + +(function testDeleteSlowSloppyArguments() { + var key = 10000; + function f(a) { + arguments[key] = key; + return arguments + }; + var args = f(1, 2); + assertEquals(1, args[0]); + assertEquals(2, args[1]); + assertEquals(key, args[key]); + assertEquals(2, args.length); + + delete args[0]; + assertEquals(undefined, args[0]); + assertEquals(2, args[1]); + assertEquals(key, args[key]); + assertEquals(2, args.length); + + delete args[1]; + assertEquals(undefined, args[0]); + assertEquals(undefined, args[1]); + assertEquals(key, args[key]); + assertEquals(2, args.length); + + delete args[key]; + assertEquals(undefined, args[0]); + assertEquals(undefined, args[1]); + assertEquals(undefined, args[key]); + assertEquals(2, args.length); +})();