AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Refactor array construction for map, filter

Browse Source 
This patch refactors array methods to have the
InnerArray{Map,Filter} methods convert to a GlobalArray
rather than the callers.

BUG=chromium:544991
R=yangguo,adamk
CC=mstarzinger,jochen
LOG=Y

Review URL: https://codereview.chromium.org/1408213004

Cr-Commit-Position: refs/heads/master@{#31403}
This commit is contained in:
littledan 2015-10-20 02:57:01 -07:00 committed by Commit bot
parent cf72aad39e
commit c227dd5734
2 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/js/array.js
View File

@ -1201,7 +1201,9 @@ function InnerArrayFilter(f, receiver, array, length) {
}
}
}
return accumulator;
var result = new GlobalArray();
%MoveArrayContents(accumulator, result);
return result;
}
function ArrayFilter(f, receiver) {
@ -1211,10 +1213,7 @@ function ArrayFilter(f, receiver) {
// loop will not affect the looping and side effects are visible.
var array = TO_OBJECT(this);
var length = TO_LENGTH_OR_UINT32(array.length);
var accumulator = InnerArrayFilter(f, receiver, array, length);
var result = new GlobalArray();
%MoveArrayContents(accumulator, result);
return result;
return InnerArrayFilter(f, receiver, array, length);
}
function InnerArrayForEach(f, receiver, array, length) {
@ -1314,7 +1313,9 @@ function InnerArrayMap(f, receiver, array, length) {
accumulator[i] = %_Call(f, receiver, element, i, array);
}
}
return accumulator;
var result = new GlobalArray();
%MoveArrayContents(accumulator, result);
return result;
}
@ -1325,10 +1326,7 @@ function ArrayMap(f, receiver) {
// loop will not affect the looping and side effects are visible.
var array = TO_OBJECT(this);
var length = TO_LENGTH_OR_UINT32(array.length);
var accumulator = InnerArrayMap(f, receiver, array, length);
var result = new GlobalArray();
%MoveArrayContents(accumulator, result);
return result;
return InnerArrayMap(f, receiver, array, length);
}

15
test/mjsunit/regress/regress-544991.js Normal file
View File

@ -0,0 +1,15 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var typedArray = new Int8Array(1);
var saved;
var called;
typedArray.constructor = function(x) { called = true; saved = x };
typedArray.constructor.prototype = Int8Array.prototype;
typedArray.map(function(){});
// To meet the spec, constructor shouldn't be called directly, but
// if it is called for now, the argument should be an Array
assertTrue(called); // Will fail later; when so, delete this test
assertEquals("Array", saved.constructor.name);