Reviewers: ulan,
Description:
Fix return value of push() and unshift() on Array.prototype.
[email protected]
TEST=mjsunit/regress/regress-builtinbust-3
Please review this at https://codereview.chromium.org/230453002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+28, -9 lines):
M src/array.js
A test/mjsunit/regress/regress-builtinbust-3.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
d158a059c678019ef2460f142eabc2e252ef4754..b3b25ed260c505f35c058c0cdabd8e8b9b8c057c
100644
--- a/src/array.js
+++ b/src/array.js
@@ -444,13 +444,14 @@ function ObservedArrayPush() {
for (var i = 0; i < m; i++) {
this[i+n] = %_Arguments(i);
}
- this.length = n + m;
+ var new_length = n + m;
+ this.length = new_length;
} finally {
EndPerformSplice(this);
EnqueueSpliceRecord(this, n, [], m);
}
- return this.length;
+ return new_length;
}
// Appends the arguments to the end of the array and returns the new
@@ -471,8 +472,10 @@ function ArrayPush() {
for (var i = 0; i < m; i++) {
this[i+n] = %_Arguments(i);
}
- this.length = n + m;
- return this.length;
+
+ var new_length = n + m;
+ this.length = new_length;
+ return new_length;
}
@@ -627,13 +630,14 @@ function ObservedArrayUnshift() {
for (var i = 0; i < num_arguments; i++) {
this[i] = %_Arguments(i);
}
- this.length = len + num_arguments;
+ var new_length = len + num_arguments;
+ this.length = new_length;
} finally {
EndPerformSplice(this);
EnqueueSpliceRecord(this, 0, [], num_arguments);
}
- return len + num_arguments;
+ return new_length;
}
function ArrayUnshift(arg1) { // length == 1
@@ -672,9 +676,9 @@ function ArrayUnshift(arg1) { // length == 1
this[i] = %_Arguments(i);
}
- this.length = len + num_arguments;
-
- return this.length;
+ var new_length = len + num_arguments;
+ this.length = new_length;
+ return new_length;
}
Index: test/mjsunit/regress/regress-builtinbust-3.js
diff --git a/test/mjsunit/regress/regress-builtinbust-3.js
b/test/mjsunit/regress/regress-builtinbust-3.js
new file mode 100644
index
0000000000000000000000000000000000000000..f5a0c39eaa4812600f07de7bbcf4c7b25457610c
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-3.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function produce_object() {
+ var real_length = 1;
+ function set_length() { real_length = "boom"; }
+ function get_length() { return real_length; }
+ var o = { __proto__:Array.prototype , 0:"x" };
+ Object.defineProperty(o, "length", { set:set_length, get:get_length })
+ return o;
+}
+
+assertEquals(2, produce_object().push("y"));
+assertEquals(2, produce_object().unshift("y"));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
