Reviewers: Toon Verwaest,
Message:
PTAL.
Description:
Correctly handle holes when concat()ing double arrays
BUG=chromium:403409
LOG=y
Please review this at https://codereview.chromium.org/468863003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+36, -9 lines):
M src/runtime.cc
A test/mjsunit/regress/regress-crbug-403409.js
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index
1fbedc6adc3cad719a24976e9929a0e686fca682..5f56953192cb5765e26f02895d28e6620b2d2bdc
100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -10541,10 +10541,10 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
Handle<FixedArrayBase> storage =
isolate->factory()->NewFixedDoubleArray(estimate_result_length);
int j = 0;
+ bool failure = false;
if (estimate_result_length > 0) {
Handle<FixedDoubleArray> double_storage =
Handle<FixedDoubleArray>::cast(storage);
- bool failure = false;
for (int i = 0; i < argument_count; i++) {
Handle<Object> obj(elements->get(i), isolate);
if (obj->IsSmi()) {
@@ -10565,6 +10565,11 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
FixedDoubleArray::cast(array->elements());
for (uint32_t i = 0; i < length; i++) {
if (elements->is_the_hole(i)) {
+ // TODO(jkummerow/verwaest): We could be a bit more
clever
+ // here: Check if there are no elements/getters on the
+ // prototype chain, and if so, allow creation of a holey
+ // result array.
+ // Same thing below (holey smi case).
failure = true;
break;
}
@@ -10591,6 +10596,7 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
break;
}
case FAST_HOLEY_ELEMENTS:
+ case FAST_ELEMENTS:
DCHECK_EQ(0, length);
break;
default:
@@ -10600,14 +10606,17 @@ RUNTIME_FUNCTION(Runtime_ArrayConcat) {
if (failure) break;
}
}
- Handle<JSArray> array = isolate->factory()->NewJSArray(0);
- Smi* length = Smi::FromInt(j);
- Handle<Map> map;
- map = JSObject::GetElementsTransitionMap(array, kind);
- array->set_map(*map);
- array->set_length(length);
- array->set_elements(*storage);
- return *array;
+ if (!failure) {
+ Handle<JSArray> array = isolate->factory()->NewJSArray(0);
+ Smi* length = Smi::FromInt(j);
+ Handle<Map> map;
+ map = JSObject::GetElementsTransitionMap(array, kind);
+ array->set_map(*map);
+ array->set_length(length);
+ array->set_elements(*storage);
+ return *array;
+ }
+ // In case of failure, fall through.
}
Handle<FixedArray> storage;
Index: test/mjsunit/regress/regress-crbug-403409.js
diff --git a/test/mjsunit/regress/regress-crbug-403409.js
b/test/mjsunit/regress/regress-crbug-403409.js
new file mode 100644
index
0000000000000000000000000000000000000000..ffd100b46895ff33662e244a6d372483caeba59f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-403409.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[0] = 777;
+var kElements = 10;
+
+var input_array = [];
+for (var i = 1; i < kElements; i++) {
+ input_array[i] = 0.5;
+}
+var output_array = input_array.concat(0.5);
+
+assertEquals(kElements + 1, output_array.length);
+assertEquals(777, output_array[0]);
+for (var j = 1; j < kElements; j++) {
+ assertEquals(0.5, output_array[j]);
+}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
