Status: Accepted
Owner: [email protected]
CC: [email protected]
Labels: Type-Bug Priority-Medium

New issue 2566 by [email protected]: Incorrect compilation of property setting for arrays when property is 'length'
http://code.google.com/p/v8/issues/detail?id=2566

In d8, the following code prints '5':

function setProp(obj, prop, val) {
  obj[prop] = val;
}
var obj = [];
setProp(obj, 'length', 1);
setProp(obj, 0, 5);
print(obj.length);

Note that it doesn't matter what the second argument to setProp() is in the second call: it will always store the val into the array length.

Reproduces both at bleeding_edge and in Chrome 26 Beta (V8 3.16.14.2).

--
You received this message because this project is configured to send all issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.


Reply via email to