Revision: 10236
Author: [email protected]
Date: Mon Dec 12 02:20:46 2011
Log: Fix another corner case for DefineOwnProperty on arrays.
[email protected]
BUG=v8:1756
TEST=test262
Review URL: http://codereview.chromium.org/8890015
http://code.google.com/p/v8/source/detail?r=10236
Modified:
/branches/bleeding_edge/src/v8natives.js
/branches/bleeding_edge/test/test262/test262.status
=======================================
--- /branches/bleeding_edge/src/v8natives.js Mon Dec 5 01:53:43 2011
+++ /branches/bleeding_edge/src/v8natives.js Mon Dec 12 02:20:46 2011
@@ -873,29 +873,33 @@
throw new $RangeError('defineProperty() array length out of range');
}
var length_desc = GetOwnProperty(obj, "length");
+ if (new_length != length && !length_desc.isWritable()) {
+ if (should_throw) {
+ throw MakeTypeError("redefine_disallowed", [p]);
+ } else {
+ return false;
+ }
+ }
+ var threw = false;
+ while (new_length < length--) {
+ if (!Delete(obj, ToString(length), false)) {
+ new_length = length + 1;
+ threw = true;
+ break;
+ }
+ }
// Make sure the below call to DefineObjectProperty() doesn't overwrite
// any magic "length" property by removing the value.
+ obj.length = new_length;
desc.value_ = void 0;
desc.hasValue_ = false;
- if ((new_length != length && !length_desc.isWritable()) ||
- !DefineObjectProperty(obj, "length", desc, should_throw)) {
+ if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw)
{
if (should_throw) {
throw MakeTypeError("redefine_disallowed", [p]);
} else {
return false;
}
}
- obj.length = new_length;
- while (new_length < length--) {
- if (!Delete(obj, length, false)) {
- obj.length = length + 1;
- if (should_throw) {
- throw MakeTypeError("redefine_disallowed", [p]);
- } else {
- return false;
- }
- }
- }
return true;
}
=======================================
--- /branches/bleeding_edge/test/test262/test262.status Mon Dec 5 03:44:17
2011
+++ /branches/bleeding_edge/test/test262/test262.status Mon Dec 12 02:20:46
2011
@@ -43,13 +43,12 @@
S15.3.3.1_A4: FAIL
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1756
-15.2.3.6-4-167: FAIL
-15.2.3.6-4-168: FAIL
-15.2.3.6-4-181: FAIL
-15.2.3.7-6-a-163: FAIL
-15.2.3.7-6-a-164: FAIL
+15.2.3.6-4-167: FAIL || PASS
+15.2.3.6-4-181: FAIL || PASS
+15.2.3.7-6-a-163: FAIL || PASS
+15.2.3.7-6-a-164: FAIL || PASS
15.2.3.7-6-a-176: FAIL || PASS
-15.2.3.7-6-a-177: FAIL
+15.2.3.7-6-a-177: FAIL || PASS
# V8 Bug: http://code.google.com/p/v8/issues/detail?id=1772
15.2.3.6-4-292-1: FAIL
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
