819d9f62d0
In ElementsAccessorBase::SetLengthImpl for a dictionary array, we try to optimize setting array length if the new length is a smi. However, we refuse to set an array length to less than the index of the highest non-configurable array element. This index may be outside of smi range. Handle this case accordingly. BUG=350887 LOG=N R=dslomov@chromium.org Review URL: https://codereview.chromium.org/194803002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19787 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
13 lines
435 B
JavaScript
13 lines
435 B
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var arr = [];
|
|
assertSame(0, arr.length);
|
|
assertSame(undefined, arr[0]);
|
|
Object.defineProperty(arr, '2501866687', { value: 4, configurable: false });
|
|
// 2501866688 is out of smi range.
|
|
assertSame(2501866688, arr.length);
|
|
assertSame(undefined, arr[0]);
|
|
arr.length = 0;
|