Reviewers: Michael Starzinger,
Message:
Quick followup to HasComplexElements().
Description:
Widen definition of %HasComplexElements() to include non-enumerability
This avoids using the Sparse methods on objects with non-enumerable
elements,
which can cause the 'enumerable: false' bit to get lost in the operation.
Please review this at https://codereview.chromium.org/672323003/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+18, -2 lines):
M src/objects.h
M src/objects.cc
A test/mjsunit/regress/regress-enumerable-element.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
4359f1738577a0fc8c449d8efecaafdbe16f4bdd..af80ce2c977ecec8238ab0dce82000fcf4b6296f
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -15274,7 +15274,7 @@ bool Dictionary<Derived, Shape,
Key>::HasComplexElements() {
if (details.IsDeleted()) continue;
if (details.type() == CALLBACKS) return true;
PropertyAttributes attr = details.attributes();
- if (attr & (READ_ONLY | DONT_DELETE)) return true;
+ if (attr & (READ_ONLY | DONT_DELETE | DONT_ENUM)) return true;
}
}
return false;
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
649111d00bc96962ff1ea377c35af3d3d61a420b..d8a26930059bf8603125178c71afb7a843752600
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -3551,7 +3551,7 @@ class Dictionary: public HashTable<Derived, Shape,
Key> {
int NumberOfEnumElements();
// Returns true if the dictionary contains any elements that are
non-writable,
- // non-configurable, or have getters/setters.
+ // non-configurable, non-enumerable, or have getters/setters.
bool HasComplexElements();
enum SortMode { UNSORTED, SORTED };
Index: test/mjsunit/regress/regress-enumerable-element.js
diff --git a/test/mjsunit/regress/regress-enumerable-element.js
b/test/mjsunit/regress/regress-enumerable-element.js
new file mode 100644
index
0000000000000000000000000000000000000000..f3ee258bf654bedaff4cdd3d197f5ff49d99e0fd
--- /dev/null
+++ b/test/mjsunit/regress/regress-enumerable-element.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [1, 2];
+Object.defineProperty(arr, 0xfffe, {
+ value: 3,
+ configurable: true,
+ writable: true,
+ enumerable: false
+});
+arr[0xffff] = 4;
+arr.shift();
+var desc = Object.getOwnPropertyDescriptor(arr, 0xfffe);
+assertEquals(4, desc.value);
+assertFalse(desc.enumerable);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
