Revision: 24884
Author: [email protected]
Date: Fri Oct 24 18:07:59 2014 UTC
Log: SimpleSlice now calls [[Get]] before [[Has]] when generating copy
SparseSlice does not need this (non-optimal) reordering since its
callers guarantee that [[Get]] has no side effects on the passed-in array.
BUG=v8:3643
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/674003002
https://code.google.com/p/v8/source/detail?r=24884
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-3643.js
Modified:
/branches/bleeding_edge/src/array.js
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-3643.js Fri Oct 24
18:07:59 2014 UTC
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [1, 2, 3];
+Object.defineProperty(a, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+});
+var s = a.slice(1);
+assertTrue('0' in s);
+
+// Sparse case should hit the same code as above due to presence of the
getter.
+a = [1, 2, 3];
+a[0xffff] = 4;
+Object.defineProperty(a, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+});
+s = a.slice(1);
+assertTrue('0' in s);
=======================================
--- /branches/bleeding_edge/src/array.js Thu Oct 23 21:13:29 2014 UTC
+++ /branches/bleeding_edge/src/array.js Fri Oct 24 18:07:59 2014 UTC
@@ -284,11 +284,8 @@
function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
for (var i = 0; i < del_count; i++) {
var index = start_i + i;
- // The spec could also be interpreted such that %HasOwnProperty
- // would be the appropriate test. We follow KJS in consulting the
- // prototype.
- var current = array[index];
- if (!IS_UNDEFINED(current) || index in array) {
+ if (index in array) {
+ var current = array[index];
// The spec requires [[DefineOwnProperty]] here, %AddElement is close
// enough (in that it ignores the prototype).
%AddElement(deleted_elements, i, current, NONE);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
