Revision: 24807
Author:   [email protected]
Date:     Wed Oct 22 13:13:19 2014 UTC
Log: Array.prototype.{reduce, reduceRight}: Wrong order of operations when determining initial value.

BUG=v8:3534
LOG=
[email protected], [email protected]

Review URL: https://codereview.chromium.org/614733002

Patch from Diego Pino <[email protected]>.
https://code.google.com/p/v8/source/detail?r=24807

Modified:
 /branches/bleeding_edge/src/array.js
 /branches/bleeding_edge/test/mjsunit/array-reduce.js

=======================================
--- /branches/bleeding_edge/src/array.js        Tue Oct 21 17:46:42 2014 UTC
+++ /branches/bleeding_edge/src/array.js        Wed Oct 22 13:13:19 2014 UTC
@@ -1418,9 +1418,8 @@
   var i = 0;
   find_initial: if (%_ArgumentsLength() < 2) {
     for (; i < length; i++) {
-      current = array[i];
-      if (!IS_UNDEFINED(current) || i in array) {
-        i++;
+      if (i in array) {
+        current = array[i++];
         break find_initial;
       }
     }
@@ -1455,9 +1454,8 @@
   var i = length - 1;
   find_initial: if (%_ArgumentsLength() < 2) {
     for (; i >= 0; i--) {
-      current = array[i];
-      if (!IS_UNDEFINED(current) || i in array) {
-        i--;
+      if (i in array) {
+        current = array[i--];
         break find_initial;
       }
     }
=======================================
--- /branches/bleeding_edge/test/mjsunit/array-reduce.js Thu Mar 27 12:32:27 2014 UTC +++ /branches/bleeding_edge/test/mjsunit/array-reduce.js Wed Oct 22 13:13:19 2014 UTC
@@ -521,3 +521,13 @@
             [3, 3, 2, [1, 2, 3, 4, 4, 5], 6],
             [6, 4, 3, [1, 2, 3, 4, 4, 5, 6], 10],
            ], arr, extender, 0);
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true });
+assertEquals(undefined, arr.reduce(function(val) { return val }));
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true});
+assertEquals(undefined, arr.reduceRight(function(val) { return val }));

--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to