Status: New
Owner: ----
New issue 3537 by [email protected]: Array.prototype.sort:
Unchecked calls to hasOwnProperty and push and sort
https://code.google.com/p/v8/issues/detail?id=3537
Deleting Array.prototype.push shouldn't affect Array.prototype.sort.
Expected: No TypeError thrown
Actual: Throws TypeError
Test case:
---
a=[];
for(i=0;i<10000;++i)a[i]={};
delete Array.prototype.push;
a.sort()
---
Expected: No TypeError thrown
Actual: Throws TypeError
Test case:
---
a=[];
for(i=0;i<10000;++i)a[i]={};
sortfn=Array.prototype.sort;
delete Array.prototype.sort;
sortfn.call(a)
---
Expected: No TypeError thrown
Actual: Throws TypeError
Test case:
---
Array.prototype.sort.call({__proto__: {hasOwnProperty: null, 0: 1},
length:5})
---
Expected: No TypeError thrown
Actual: Throws TypeError
Test case:
---
a=new Array(2);
Object.defineProperty(a, "0", {get:function(){}, set:function(){},
configurable:true});
a.hasOwnProperty = null;
a.sort();
---
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
