v8/test/mjsunit/array-push3.js
danno@chromium.org 2e9902b22a Partially fix semantics of Array.push()
Semantics of elements accessors are now preserved in all optimized code paths
through Array.push(). Previously it was possible to have inconsistent behavior
between optimized and unoptimized code, and there were cases where element
accessors were completely ingored.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/232873002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20655 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2014-04-10 13:17:48 +00:00

30 lines
605 B
JavaScript

// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var array = [];
function push(array, value) {
array.push(value);
}
push(array, 0);
push(array, 1);
push(array, 2);
%OptimizeFunctionOnNextCall(push);
push(array, 3);
var v = 0;
Object.defineProperty(Array.prototype, "4", {
get: function() { return 100; },
set: function(value) { v = value; }
});
push(array, 4);
assertEquals(5, array.length);
assertEquals(100, array[4]);
assertEquals(4, v);