Revision: 24784
Author: [email protected]
Date: Tue Oct 21 17:46:42 2014 UTC
Log: Array.prototype.{slice,splice} should use [[DefineOwnProperty]]
to generate return value
BUG=chromium:423633
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/649063003
https://code.google.com/p/v8/source/detail?r=24784
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-423633.js
Modified:
/branches/bleeding_edge/src/array.js
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-423633.js Tue Oct
21 17:46:42 2014 UTC
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Array.prototype, '0', {
+ get: function() { return false; },
+});
+var a = [1, 2, 3];
+assertEquals(a, a.slice());
+assertEquals([3], a.splice(2, 1));
=======================================
--- /branches/bleeding_edge/src/array.js Tue Oct 21 17:21:32 2014 UTC
+++ /branches/bleeding_edge/src/array.js Tue Oct 21 17:46:42 2014 UTC
@@ -286,7 +286,9 @@
// prototype.
var current = array[index];
if (!IS_UNDEFINED(current) || index in array) {
- deleted_elements[i] = current;
+ // The spec requires [[DefineOwnProperty]] here, %AddElement is close
+ // enough (in that it ignores the prototype).
+ %AddElement(deleted_elements, i, current, NONE);
}
}
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
