Reviewers: rossberg,
Description:
Fix another corner case for DefineOwnProperty on arrays.
[email protected]
BUG=v8:1756
TEST=test262
Please review this at http://codereview.chromium.org/8890015/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/v8natives.js
M test/test262/test262.status
Index: src/v8natives.js
diff --git a/src/v8natives.js b/src/v8natives.js
index
61b130c196db2462289abe12e9aea7a7012bdfe7..1d54e28e97687ca981372b41525ffbed6b150e3a
100644
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -873,29 +873,33 @@ function DefineArrayProperty(obj, p, desc,
should_throw) {
throw new $RangeError('defineProperty() array length out of range');
}
var length_desc = GetOwnProperty(obj, "length");
+ if (new_length != length && !length_desc.isWritable()) {
+ if (should_throw) {
+ throw MakeTypeError("redefine_disallowed", [p]);
+ } else {
+ return false;
+ }
+ }
+ var threw = false;
+ while (new_length < length--) {
+ if (!Delete(obj, ToString(length), false)) {
+ new_length = length + 1;
+ threw = true;
+ break;
+ }
+ }
// Make sure the below call to DefineObjectProperty() doesn't overwrite
// any magic "length" property by removing the value.
+ obj.length = new_length;
desc.value_ = void 0;
desc.hasValue_ = false;
- if ((new_length != length && !length_desc.isWritable()) ||
- !DefineObjectProperty(obj, "length", desc, should_throw)) {
+ if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw)
{
if (should_throw) {
throw MakeTypeError("redefine_disallowed", [p]);
} else {
return false;
}
}
- obj.length = new_length;
- while (new_length < length--) {
- if (!Delete(obj, length, false)) {
- obj.length = length + 1;
- if (should_throw) {
- throw MakeTypeError("redefine_disallowed", [p]);
- } else {
- return false;
- }
- }
- }
return true;
}
Index: test/test262/test262.status
diff --git a/test/test262/test262.status b/test/test262/test262.status
index
20955ac82e1316097e6aa5eec3b5681859b12b53..c7d363d0db0dddb4683f260e16e416c592cdebd7
100644
--- a/test/test262/test262.status
+++ b/test/test262/test262.status
@@ -43,13 +43,12 @@ S10.4.2.1_A1: FAIL
S15.3.3.1_A4: FAIL
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1756
-15.2.3.6-4-167: FAIL
-15.2.3.6-4-168: FAIL
-15.2.3.6-4-181: FAIL
-15.2.3.7-6-a-163: FAIL
-15.2.3.7-6-a-164: FAIL
+15.2.3.6-4-167: FAIL || PASS
+15.2.3.6-4-181: FAIL || PASS
+15.2.3.7-6-a-163: FAIL || PASS
+15.2.3.7-6-a-164: FAIL || PASS
15.2.3.7-6-a-176: FAIL || PASS
-15.2.3.7-6-a-177: FAIL
+15.2.3.7-6-a-177: FAIL || PASS
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1772
15.2.3.6-4-292-1: FAIL
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
