Reviewers: rossberg,
Description:
When notifying observers of a truncated array, don't call getters on deleted
element indices
BUG=v8:2409
Please review this at https://codereview.chromium.org/11414177/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects.cc
M test/mjsunit/harmony/object-observe.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
944c5a15e596a885beb807833bdcc40e1fad9508..6b991ebf131e100fbcefd4abe48ca8b37711bacc
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9442,8 +9442,10 @@ MaybeObject* JSArray::SetElementsLength(Object* len)
{
// A non-configurable property will cause the truncation operation to
// stop at this index.
if (attributes == DONT_DELETE) break;
- // TODO(adamk): Don't fetch the old value if it's an accessor.
- old_values.Add(Object::GetElement(self, i));
+ old_values.Add(
+ self->GetLocalElementAccessorPair(i) == NULL
+ ? Object::GetElement(self, i)
+ : Handle<Object>::cast(isolate->factory()->the_hole_value()));
indices.Add(isolate->factory()->Uint32ToString(i));
}
Index: test/mjsunit/harmony/object-observe.js
diff --git a/test/mjsunit/harmony/object-observe.js
b/test/mjsunit/harmony/object-observe.js
index
474bfcd3bc49bb7aeb8f7a8d92e97f725161ca5d..d88c24eac5bcd87c98ecf0e7b6899ada76c0e050
100644
--- a/test/mjsunit/harmony/object-observe.js
+++ b/test/mjsunit/harmony/object-observe.js
@@ -584,8 +584,7 @@ Object.defineProperty(arr3, 'length', {value: 10,
writable: false});
Object.deliverChangeRecords(observer.callback);
observer.assertCallbackRecords([
{ object: arr, name: '3', type: 'deleted', oldValue: 'd' },
- // TODO(adamk): oldValue should not be present below
- { object: arr, name: '2', type: 'deleted', oldValue: undefined },
+ { object: arr, name: '2', type: 'deleted' },
{ object: arr, name: 'length', type: 'updated', oldValue: 4 },
{ object: arr, name: '1', type: 'deleted', oldValue: 'b' },
{ object: arr, name: 'length', type: 'updated', oldValue: 2 },
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
