Revision: 23144
Author: [email protected]
Date: Mon Aug 18 08:51:35 2014 UTC
Log: Correctly handle holes when concat()ing double arrays
BUG=chromium:403409
LOG=y
[email protected]
Review URL: https://codereview.chromium.org/468863003
http://code.google.com/p/v8/source/detail?r=23144
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-403409.js
Modified:
/branches/bleeding_edge/src/runtime.cc
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-403409.js
Mon Aug 18 08:51:35 2014 UTC
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[0] = 777;
+var kElements = 10;
+
+var input_array = [];
+for (var i = 1; i < kElements; i++) {
+ input_array[i] = 0.5;
+}
+var output_array = input_array.concat(0.5);
+
+assertEquals(kElements + 1, output_array.length);
+assertEquals(777, output_array[0]);
+for (var j = 1; j < kElements; j++) {
+ assertEquals(0.5, output_array[j]);
+}
=======================================
--- /branches/bleeding_edge/src/runtime.cc Mon Aug 18 07:54:19 2014 UTC
+++ /branches/bleeding_edge/src/runtime.cc Mon Aug 18 08:51:35 2014 UTC
@@ -10541,10 +10541,10 @@
Handle<FixedArrayBase> storage =
isolate->factory()->NewFixedDoubleArray(estimate_result_length);
int j = 0;
+ bool failure = false;
if (estimate_result_length > 0) {
Handle<FixedDoubleArray> double_storage =
Handle<FixedDoubleArray>::cast(storage);
- bool failure = false;
for (int i = 0; i < argument_count; i++) {
Handle<Object> obj(elements->get(i), isolate);
if (obj->IsSmi()) {
@@ -10565,6 +10565,11 @@
FixedDoubleArray::cast(array->elements());
for (uint32_t i = 0; i < length; i++) {
if (elements->is_the_hole(i)) {
+ // TODO(jkummerow/verwaest): We could be a bit more
clever
+ // here: Check if there are no elements/getters on the
+ // prototype chain, and if so, allow creation of a holey
+ // result array.
+ // Same thing below (holey smi case).
failure = true;
break;
}
@@ -10591,6 +10596,7 @@
break;
}
case FAST_HOLEY_ELEMENTS:
+ case FAST_ELEMENTS:
DCHECK_EQ(0, length);
break;
default:
@@ -10600,14 +10606,17 @@
if (failure) break;
}
}
- Handle<JSArray> array = isolate->factory()->NewJSArray(0);
- Smi* length = Smi::FromInt(j);
- Handle<Map> map;
- map = JSObject::GetElementsTransitionMap(array, kind);
- array->set_map(*map);
- array->set_length(length);
- array->set_elements(*storage);
- return *array;
+ if (!failure) {
+ Handle<JSArray> array = isolate->factory()->NewJSArray(0);
+ Smi* length = Smi::FromInt(j);
+ Handle<Map> map;
+ map = JSObject::GetElementsTransitionMap(array, kind);
+ array->set_map(*map);
+ array->set_length(length);
+ array->set_elements(*storage);
+ return *array;
+ }
+ // In case of failure, fall through.
}
Handle<FixedArray> storage;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
