Reviewers: Toon Verwaest,
Description:
Fix sparse versions of Array slice/splice to use [[DefineOwnProperty]] to
generate return value
BUG=chromium:423633
LOG=n
Please review this at https://codereview.chromium.org/673893002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+10, -2 lines):
M src/array.js
M test/mjsunit/regress/regress-423633.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
9fbc67cdce80c4bfa5d3ee066d9ef1d900a25646..a4e681c7e2a212df91a5118b5e9286a1b5d2575a
100644
--- a/src/array.js
+++ b/src/array.js
@@ -212,7 +212,7 @@ function SparseSlice(array, start_i, del_count, len,
deleted_elements) {
for (var i = start_i; i < limit; ++i) {
var current = array[i];
if (!IS_UNDEFINED(current) || i in array) {
- deleted_elements[i - start_i] = current;
+ %AddElement(deleted_elements, i - start_i, current, NONE);
}
}
} else {
@@ -223,7 +223,7 @@ function SparseSlice(array, start_i, del_count, len,
deleted_elements) {
if (key >= start_i) {
var current = array[key];
if (!IS_UNDEFINED(current) || key in array) {
- deleted_elements[key - start_i] = current;
+ %AddElement(deleted_elements, key - start_i, current, NONE);
}
}
}
Index: test/mjsunit/regress/regress-423633.js
diff --git a/test/mjsunit/regress/regress-423633.js
b/test/mjsunit/regress/regress-423633.js
index
cad20645ba942417f75f07bc124172bfeef8320e..12d248333fbacbb1e0acb00887523f880fc7d603
100644
--- a/test/mjsunit/regress/regress-423633.js
+++ b/test/mjsunit/regress/regress-423633.js
@@ -8,3 +8,11 @@ Object.defineProperty(Array.prototype, '0', {
var a = [1, 2, 3];
assertEquals(a, a.slice());
assertEquals([3], a.splice(2, 1));
+
+a = [1, 2, 3];
+a[0xffff] = 4;
+// nulling the prototype lets us stay in the sparse case; otherwise the
+// getter on Array.prototype would force us into the non-sparse code.
+a.__proto__ = null;
+assertEquals(a, Array.prototype.slice.call(a));
+assertEquals([3], Array.prototype.splice.call(a, 2, 1));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
