Reviewers: Michael Starzinger,
Description:
SimpleSlice now calls [[Get]] before [[Has]] when generating copy
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.
BUG=v8:3643
LOG=n
Please review this at https://codereview.chromium.org/674003002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+23, -5 lines):
M src/array.js
A test/mjsunit/regress/regress-3643.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
a4e681c7e2a212df91a5118b5e9286a1b5d2575a..55dd79751c27fc960c5caca1bc068b7a0c5ecc22
100644
--- a/src/array.js
+++ b/src/array.js
@@ -284,11 +284,8 @@ function SparseMove(array, start_i, del_count, len,
num_additional_args) {
function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
for (var i = 0; i < del_count; i++) {
var index = start_i + i;
- // The spec could also be interpreted such that %HasOwnProperty
- // would be the appropriate test. We follow KJS in consulting the
- // prototype.
- var current = array[index];
- if (!IS_UNDEFINED(current) || index in array) {
+ if (index in array) {
+ var current = array[index];
// The spec requires [[DefineOwnProperty]] here, %AddElement is close
// enough (in that it ignores the prototype).
%AddElement(deleted_elements, i, current, NONE);
Index: test/mjsunit/regress/regress-3643.js
diff --git a/test/mjsunit/regress/regress-3643.js
b/test/mjsunit/regress/regress-3643.js
new file mode 100644
index
0000000000000000000000000000000000000000..cc61a1c68ec5628674b97a469162aef85d40dec4
--- /dev/null
+++ b/test/mjsunit/regress/regress-3643.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [1, 2, 3];
+Object.defineProperty(a, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+});
+var s = a.slice(1);
+assertTrue('0' in s);
+
+// Sparse case should hit the same code as above due to presence of the
getter.
+a = [1, 2, 3];
+a[0xffff] = 4;
+Object.defineProperty(a, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+});
+s = a.slice(1);
+assertTrue('0' in s);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
