AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

SimpleMove now calls [[Has]] before [[Get]] when moving elements

Browse Source 
BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/678753002

Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
adamk@chromium.org 2014-10-27 13:04:46 +00:00
parent 02934fe48f
commit f1954232b0
2 changed files with 23 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/array.js
View File

@ -302,12 +302,8 @@ function SimpleMove(array, start_i, del_count, len, num_additional_args) {
for (var i = len - del_count; i > start_i; i--) {
var from_index = i + del_count - 1;
var to_index = i + num_additional_args - 1;
// The spec could also be interpreted such that
// %HasOwnProperty would be the appropriate test. We follow
// KJS in consulting the prototype.
var current = array[from_index];
if (!IS_UNDEFINED(current) || from_index in array) {
array[to_index] = current;
if (from_index in array) {
array[to_index] = array[from_index];
} else {
delete array[to_index];
}
@ -316,12 +312,8 @@ function SimpleMove(array, start_i, del_count, len, num_additional_args) {
for (var i = start_i; i < len - del_count; i++) {
var from_index = i + del_count;
var to_index = i + num_additional_args;
// The spec could also be interpreted such that
// %HasOwnProperty would be the appropriate test. We follow
// KJS in consulting the prototype.
var current = array[from_index];
if (!IS_UNDEFINED(current) || from_index in array) {
array[to_index] = current;
if (from_index in array) {
array[to_index] = array[from_index];
} else {
delete array[to_index];
}

29
test/mjsunit/regress/regress-3643.js
View File

@ -2,20 +2,29 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [1, 2, 3];
Object.defineProperty(a, '1', {
get: function() { delete this[1]; return undefined; },
configurable: true
});
function newArrayWithGetter() {
var arr = [1, 2, 3];
Object.defineProperty(arr, '1', {
get: function() { delete this[1]; return undefined; },
configurable: true
});
return arr;
}
var a = newArrayWithGetter();
var s = a.slice(1);
assertTrue('0' in s);
// Sparse case should hit the same code as above due to presence of the getter.
a = [1, 2, 3];
a = newArrayWithGetter();
a[0xffff] = 4;
Object.defineProperty(a, '1', {
get: function() { delete this[1]; return undefined; },
configurable: true
});
s = a.slice(1);
assertTrue('0' in s);
a = newArrayWithGetter();
a.shift();
assertTrue('0' in a);
a = newArrayWithGetter();
a.unshift(0);
assertTrue('2' in a);