Reviewers: Michael Starzinger,
Description:
SimpleMove now calls [[Has]] before [[Get]] when moving elements
BUG=v8:3643
LOG=n
Please review this at https://codereview.chromium.org/678753002/
Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+23, -22 lines):
M src/array.js
M test/mjsunit/regress/regress-3643.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
55dd79751c27fc960c5caca1bc068b7a0c5ecc22..29fa8318e2bfee8c8cfa4ba95af4da5bd777590e
100644
--- a/src/array.js
+++ b/src/array.js
@@ -302,12 +302,8 @@ function SimpleMove(array, start_i, del_count, len,
num_additional_args) {
for (var i = len - del_count; i > start_i; i--) {
var from_index = i + del_count - 1;
var to_index = i + num_additional_args - 1;
- // The spec could also be interpreted such that
- // %HasOwnProperty would be the appropriate test. We follow
- // KJS in consulting the prototype.
- var current = array[from_index];
- if (!IS_UNDEFINED(current) || from_index in array) {
- array[to_index] = current;
+ if (from_index in array) {
+ array[to_index] = array[from_index];
} else {
delete array[to_index];
}
@@ -316,12 +312,8 @@ function SimpleMove(array, start_i, del_count, len,
num_additional_args) {
for (var i = start_i; i < len - del_count; i++) {
var from_index = i + del_count;
var to_index = i + num_additional_args;
- // The spec could also be interpreted such that
- // %HasOwnProperty would be the appropriate test. We follow
- // KJS in consulting the prototype.
- var current = array[from_index];
- if (!IS_UNDEFINED(current) || from_index in array) {
- array[to_index] = current;
+ if (from_index in array) {
+ array[to_index] = array[from_index];
} else {
delete array[to_index];
}
Index: test/mjsunit/regress/regress-3643.js
diff --git a/test/mjsunit/regress/regress-3643.js
b/test/mjsunit/regress/regress-3643.js
index
cc61a1c68ec5628674b97a469162aef85d40dec4..bbc94fd73b9905445c465c43709568b6a68b8367
100644
--- a/test/mjsunit/regress/regress-3643.js
+++ b/test/mjsunit/regress/regress-3643.js
@@ -2,20 +2,29 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-var a = [1, 2, 3];
-Object.defineProperty(a, '1', {
- get: function() { delete this[1]; return undefined; },
- configurable: true
-});
+function newArrayWithGetter() {
+ var arr = [1, 2, 3];
+ Object.defineProperty(arr, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+ });
+ return arr;
+}
+
+var a = newArrayWithGetter();
var s = a.slice(1);
assertTrue('0' in s);
// Sparse case should hit the same code as above due to presence of the
getter.
-a = [1, 2, 3];
+a = newArrayWithGetter();
a[0xffff] = 4;
-Object.defineProperty(a, '1', {
- get: function() { delete this[1]; return undefined; },
- configurable: true
-});
s = a.slice(1);
assertTrue('0' in s);
+
+a = newArrayWithGetter();
+a.shift();
+assertTrue('0' in a);
+
+a = newArrayWithGetter();
+a.unshift(0);
+assertTrue('2' in a);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
