Revision: 24856
Author: [email protected]
Date: Thu Oct 23 21:13:29 2014 UTC
Log: Fix sparse versions of Array slice/splice to use
[[DefineOwnProperty]] to generate return value
BUG=chromium:423633
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/673893002
https://code.google.com/p/v8/source/detail?r=24856
Modified:
/branches/bleeding_edge/src/array.js
/branches/bleeding_edge/test/mjsunit/regress/regress-423633.js
=======================================
--- /branches/bleeding_edge/src/array.js Thu Oct 23 18:21:50 2014 UTC
+++ /branches/bleeding_edge/src/array.js Thu Oct 23 21:13:29 2014 UTC
@@ -212,7 +212,7 @@
for (var i = start_i; i < limit; ++i) {
var current = array[i];
if (!IS_UNDEFINED(current) || i in array) {
- deleted_elements[i - start_i] = current;
+ %AddElement(deleted_elements, i - start_i, current, NONE);
}
}
} else {
@@ -223,7 +223,7 @@
if (key >= start_i) {
var current = array[key];
if (!IS_UNDEFINED(current) || key in array) {
- deleted_elements[key - start_i] = current;
+ %AddElement(deleted_elements, key - start_i, current, NONE);
}
}
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-423633.js Tue Oct
21 17:46:42 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-423633.js Thu Oct
23 21:13:29 2014 UTC
@@ -8,3 +8,11 @@
var a = [1, 2, 3];
assertEquals(a, a.slice());
assertEquals([3], a.splice(2, 1));
+
+a = [1, 2, 3];
+a[0xffff] = 4;
+// nulling the prototype lets us stay in the sparse case; otherwise the
+// getter on Array.prototype would force us into the non-sparse code.
+a.__proto__ = null;
+assertEquals(a, Array.prototype.slice.call(a));
+assertEquals([3], Array.prototype.splice.call(a, 2, 1));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
