LGTM

http://codereview.chromium.org/6613005/diff/2001/src/runtime.cc
File src/runtime.cc (right):

http://codereview.chromium.org/6613005/diff/2001/src/runtime.cc#newcode8675
src/runtime.cc:8675: SetElement(jsobject, index1, tmp2, kNonStrictMode);
It's used only internally in the Array.prototype.sort implementation,
and that's defined as doing a sequence of [[Get]], [[Put]], [[Delete]]
and calls to the compare function, where the "throw" argument to [[Put]]
must be true.
I.e., we should throw if [[Put]](i,v,true) would throw (ES5 8.12.5,
refers to [[CanPut]], 8.12.14) which is when there is either no setter
for an accessor property or if [[Writable]] is false for a data
accessor.
Or if the object isn't extensible (frozen), unless it inherits a setter
accessor.
Or some more twisted logic.

(I think the [[CanPut]] spec is wrong, it sees to only consider the
immediate prototype in the prototype chain).

In any case, I would go kStrictMode here and see if it breaks anything.
Never sort with write-only properties in your array!

http://codereview.chromium.org/6613005/

--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev

Reply via email to