Reviewers: Mads Ager, Lasse Reichstein,
Message:
Lasse, Mads,
may you have a look?
Description:
Properly process arrays with overridden prototype in various Array's
functions.
Bailout to JS Array builtins if array's prototype is different from
Array.prototype. Otherwise there might be inherited elements coming
from this prototype.
Please review this at http://codereview.chromium.org/2037008/show
Affected files:
M src/builtins.cc
M test/mjsunit/array-concat.js
M test/mjsunit/array-pop.js
M test/mjsunit/array-shift.js
M test/mjsunit/array-slice.js
M test/mjsunit/array-splice.js
M test/mjsunit/array-unshift.js
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
