Reviewers: mvstanton,
Message:
PTAL
Description:
ArrayUnshift() should not modify length of a frozen object.
BUG=350890
LOG=N
Please review this at https://codereview.chromium.org/194873003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+6, -4 lines):
M src/array.js
A + test/mjsunit/regress/regress-350890.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
372b7ece6382118a7a578e9a2d0f40ac43ae222a..b68876a14ce5d7483b30ce6e0fbb065366247839
100644
--- a/src/array.js
+++ b/src/array.js
@@ -663,6 +663,7 @@ function ArrayUnshift(arg1) { // length == 1
["Array.prototype.shift"]);
}
}
+ return this.length;
}
SimpleMove(this, 0, 0, len, num_arguments);
Index: test/mjsunit/regress/regress-350890.js
diff --git a/test/mjsunit/regress/regress-347912.js
b/test/mjsunit/regress/regress-350890.js
similarity index 70%
copy from test/mjsunit/regress/regress-347912.js
copy to test/mjsunit/regress/regress-350890.js
index
b609e36c3d4981219abcd1c244ab46f849b2863b..9efe4208d3a3712bd0c717f787eaa47a8198bf74
100644
--- a/test/mjsunit/regress/regress-347912.js
+++ b/test/mjsunit/regress/regress-350890.js
@@ -4,7 +4,8 @@
// Flags: --allow-natives-syntax
-var __v_4 = {};
-__v_2 = {};
-__v_2[1024] = 0;
-%DebugPrint(__v_4);
+var a = [4.2];
+a.unshift();
+Object.freeze(a);
+a.unshift();
+assertEquals(1, a.length);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
