AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[array] Disable DCHECK in RemoveArrayHoles.

Browse Source 
This CL disables a DCHECK in RemoveArrayHoles that was triggered for
JSArrays that have read-only elements in the prototype chain.

The DCHECK is not removed because it will be re-enabled later when
the copying from the prototype chain (during sorting) will be done
for JSArrays as well.

R=cbruni@chromium.org

Bug: chromium:840855
Change-Id: Ia278bd2f060df094f477b4efbc3f5bdafd7ea7a8
Reviewed-on: https://chromium-review.googlesource.com/1057588
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53159}
This commit is contained in:
Simon Zünd 2018-05-14 15:36:27 +02:00 committed by Commit Bot
parent db8bc0adbc
commit d25840c35c
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/runtime/runtime-array.cc
View File

@ -146,7 +146,10 @@ Object* PrepareElementsForSortGeneric(Handle<JSReceiver> receiver,
isolate->factory()->undefined_value(),
LanguageMode::kStrict));
}
DCHECK_LE(current_pos, num_indices);
// TODO(szuend): Re-enable when we also copy from the prototype chain for
// JSArrays. Then we can use HasOwnProperty instead of
// HasElement and this condition will hold.
// DCHECK_LE(current_pos, num_indices);
// Deleting everything after the undefineds up unto the limit.
for (int i = num_indices - 1; i >= 0; --i) {