AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix bogus call to Object.hasOwnProperty in Array builtin.

Browse Source 
R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-builtinbust-5

Review URL: https://codereview.chromium.org/239033002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2014-04-15 12:52:41 +00:00
parent 1a44233cef
commit e51d6462a7
2 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/array.js
View File

@ -651,17 +651,6 @@ function ArrayUnshift(arg1) { // length == 1
if (IS_ARRAY(this) && !is_sealed) { if (IS_ARRAY(this) && !is_sealed) {
SmartMove(this, 0, 0, len, num_arguments); SmartMove(this, 0, 0, len, num_arguments);
} else { } else {
if (num_arguments == 0 && ObjectIsFrozen(this)) {
// In the zero argument case, values from the prototype come into the
// object. This can't be allowed on frozen arrays.
for (var i = 0; i < len; i++) {
if (!this.hasOwnProperty(i) && !IS_UNDEFINED(this[i])) {
throw MakeTypeError("array_functions_on_frozen",
["Array.prototype.shift"]);
}
}
}
SimpleMove(this, 0, 0, len, num_arguments); SimpleMove(this, 0, 0, len, num_arguments);
} }

13
test/mjsunit/regress/regress-builtinbust-5.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [ 1, 2, 3 ];
var was_called = false;
function poison() { was_called = true; }
a.hasOwnProperty = poison;
Object.freeze(a);
assertThrows("a.unshift()", TypeError);
assertEquals(3, a.length);
assertFalse(was_called);