Comment #2 on issue 3239 by [email protected]: Array.splice & Array.length
truncation create and mutate regular Arrays whose prototypes may have been
altered
https://code.google.com/p/v8/issues/detail?id=3239
I believe this got partly fixed in
https://code.google.com/p/v8/source/detail?r=24784 and
https://code.google.com/p/v8/source/detail?r=24856.
But it still looks like we access the prototype to make an array copy. The
following test case throws, and shouldn't:
var arr = [0, 1, 2];
Array.observe(arr, function(){});
Array.prototype.slice = function() { throw Error('Foo'); };
arr.splice(0, 1);
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
