AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix empty push bug in Array.push

Browse Source 
BUG=chromium:670981
LOG=N
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2609973002
Cr-Commit-Position: refs/heads/master@{#42064}
This commit is contained in:
danno 2017-01-04 02:57:26 -08:00 committed by Commit bot
parent 2a60fd49db
commit fcffcba725
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/code-stub-assembler.cc
View File

@ -1491,7 +1491,7 @@ Node* CodeStubAssembler::BuildAppendJSArray(ElementsKind kind, Node* context,
Node* growth = IntPtrSub(args.GetLength(), first);
Node* new_length =
IntPtrOrSmiAdd(WordToParameter(growth, mode), var_length.value(), mode);
GotoUnless(IntPtrOrSmiGreaterThanOrEqual(new_length, capacity, mode), &fits);
GotoUnless(IntPtrOrSmiGreaterThan(new_length, capacity, mode), &fits);
Node* new_capacity = CalculateNewElementsCapacity(
IntPtrOrSmiAdd(new_length, IntPtrOrSmiConstant(1, mode), mode), mode);
var_elements.Bind(GrowElementsCapacity(array, var_elements.value(), kind,
@ -8211,6 +8211,11 @@ Node* CodeStubArguments::GetReceiver() const {
Node* CodeStubArguments::AtIndex(Node* index,
CodeStubAssembler::ParameterMode mode) const {
typedef compiler::Node Node;
CSA_ASSERT(assembler_, assembler_->UintPtrLessThan(
mode == CodeStubAssembler::INTPTR_PARAMETERS
? index
: assembler_->SmiUntag(index),
GetLength()));
Node* negated_index =
assembler_->IntPtrSub(assembler_->IntPtrOrSmiConstant(0, mode), index);
Node* offset =

8
test/mjsunit/regress/regress-670981-array-push.js Normal file
View File

@ -0,0 +1,8 @@
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var array = [];
array.length = .6e+7;
array.push( );
assertEquals(array.length, .6e+7);