Revision: 20413
Author: [email protected]
Date: Tue Apr 1 18:39:50 2014 UTC
Log: Merged r20300 into 3.25 branch.
Fix JSObject::SetElement for fixed typed array elements.
BUG=357108
LOG=N
[email protected]
Review URL: https://codereview.chromium.org/221233002
http://code.google.com/p/v8/source/detail?r=20413
Added:
/branches/3.25/test/mjsunit/regress/regress-357108.js
Modified:
/branches/3.25/src/objects.cc
/branches/3.25/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.25/test/mjsunit/regress/regress-357108.js Tue Apr 1
18:39:50 2014 UTC
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+ function Check(a) {
+ a[0] = "";
+ assertEquals(0, a[0]);
+ a[0] = {};
+ assertEquals(0, a[0]);
+ a[0] = { valueOf : function() { return 27; } };
+ assertEquals(27, a[0]);
+ }
+ Check(new constructor(1));
+ Check(new constructor(100));
+}
+
+TestArray(Uint8Array);
=======================================
--- /branches/3.25/src/objects.cc Thu Mar 27 01:04:43 2014 UTC
+++ /branches/3.25/src/objects.cc Tue Apr 1 18:39:50 2014 UTC
@@ -12410,7 +12410,8 @@
SetPropertyMode set_mode) {
Isolate* isolate = object->GetIsolate();
- if (object->HasExternalArrayElements()) {
+ if (object->HasExternalArrayElements() ||
+ object->HasFixedTypedArrayElements()) {
if (!value->IsNumber() && !value->IsUndefined()) {
bool has_exception;
Handle<Object> number =
=======================================
--- /branches/3.25/src/version.cc Tue Apr 1 13:09:13 2014 UTC
+++ /branches/3.25/src/version.cc Tue Apr 1 18:39:50 2014 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 25
#define BUILD_NUMBER 28
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
