Revision: 24907
Author: [email protected]
Date: Mon Oct 27 13:04:46 2014 UTC
Log: SimpleMove now calls [[Has]] before [[Get]] when moving elements
BUG=v8:3643
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/678753002
https://code.google.com/p/v8/source/detail?r=24907
Modified:
/branches/bleeding_edge/src/array.js
/branches/bleeding_edge/test/mjsunit/regress/regress-3643.js
=======================================
--- /branches/bleeding_edge/src/array.js Fri Oct 24 18:07:59 2014 UTC
+++ /branches/bleeding_edge/src/array.js Mon Oct 27 13:04:46 2014 UTC
@@ -302,12 +302,8 @@
for (var i = len - del_count; i > start_i; i--) {
var from_index = i + del_count - 1;
var to_index = i + num_additional_args - 1;
- // The spec could also be interpreted such that
- // %HasOwnProperty would be the appropriate test. We follow
- // KJS in consulting the prototype.
- var current = array[from_index];
- if (!IS_UNDEFINED(current) || from_index in array) {
- array[to_index] = current;
+ if (from_index in array) {
+ array[to_index] = array[from_index];
} else {
delete array[to_index];
}
@@ -316,12 +312,8 @@
for (var i = start_i; i < len - del_count; i++) {
var from_index = i + del_count;
var to_index = i + num_additional_args;
- // The spec could also be interpreted such that
- // %HasOwnProperty would be the appropriate test. We follow
- // KJS in consulting the prototype.
- var current = array[from_index];
- if (!IS_UNDEFINED(current) || from_index in array) {
- array[to_index] = current;
+ if (from_index in array) {
+ array[to_index] = array[from_index];
} else {
delete array[to_index];
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-3643.js Fri Oct 24
18:07:59 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-3643.js Mon Oct 27
13:04:46 2014 UTC
@@ -2,20 +2,29 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
-var a = [1, 2, 3];
-Object.defineProperty(a, '1', {
- get: function() { delete this[1]; return undefined; },
- configurable: true
-});
+function newArrayWithGetter() {
+ var arr = [1, 2, 3];
+ Object.defineProperty(arr, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+ });
+ return arr;
+}
+
+var a = newArrayWithGetter();
var s = a.slice(1);
assertTrue('0' in s);
// Sparse case should hit the same code as above due to presence of the
getter.
-a = [1, 2, 3];
+a = newArrayWithGetter();
a[0xffff] = 4;
-Object.defineProperty(a, '1', {
- get: function() { delete this[1]; return undefined; },
- configurable: true
-});
s = a.slice(1);
assertTrue('0' in s);
+
+a = newArrayWithGetter();
+a.shift();
+assertTrue('0' in a);
+
+a = newArrayWithGetter();
+a.unshift(0);
+assertTrue('2' in a);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
