AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix JSObject::EnsureCanContainElements to correctly iterate over Arguments

Browse Source 
TEST=mjsunit/elements-kind.js

Review URL: http://codereview.chromium.org/8437094

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9881 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
jkummerow@chromium.org 2011-11-04 12:31:44 +00:00
parent 8450c60d47
commit f2787a42b0
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/objects.cc
View File

@ -8743,7 +8743,12 @@ MaybeObject* JSReceiver::SetPrototype(Object* value,
MaybeObject* JSObject::EnsureCanContainElements(Arguments* args,
uint32_t first_arg,
uint32_t arg_count) {
return EnsureCanContainElements(args->arguments() - first_arg, arg_count);
// Elements in |Arguments| are ordered backwards (because they're on the
// stack), but the method that's called here iterates over them in forward
// direction.
return EnsureCanContainElements(
args->arguments() - first_arg - (arg_count - 1),
arg_count);
}

9
test/mjsunit/elements-kind.js
View File

@ -317,5 +317,14 @@ if (support_smi_only_arrays) {
assertKind(elements_kind.fast, c);
}
// Test that Array.push() correctly handles SMI elements.
if (support_smi_only_arrays) {
var a = [1, 2];
assertKind(elements_kind.fast_smi_only, a);
a.push(3, 4, 5);
assertKind(elements_kind.fast_smi_only, a);
assertEquals([1, 2, 3, 4, 5], a);
}
// Throw away type information in the ICs for next stress run.
gc();