Revision: 20602
Author: [email protected]
Date: Wed Apr 9 09:14:56 2014 UTC
Log: Fix return value of push() and unshift() on Array.prototype.
[email protected]
TEST=mjsunit/regress/regress-builtinbust-3
Review URL: https://codereview.chromium.org/230453002
http://code.google.com/p/v8/source/detail?r=20602
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-builtinbust-3.js
Modified:
/branches/bleeding_edge/src/array.js
=======================================
--- /dev/null
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-builtinbust-3.js
Wed Apr 9 09:14:56 2014 UTC
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function produce_object() {
+ var real_length = 1;
+ function set_length() { real_length = "boom"; }
+ function get_length() { return real_length; }
+ var o = { __proto__:Array.prototype , 0:"x" };
+ Object.defineProperty(o, "length", { set:set_length, get:get_length })
+ return o;
+}
+
+assertEquals(2, produce_object().push("y"));
+assertEquals(2, produce_object().unshift("y"));
=======================================
--- /branches/bleeding_edge/src/array.js Thu Apr 3 12:23:35 2014 UTC
+++ /branches/bleeding_edge/src/array.js Wed Apr 9 09:14:56 2014 UTC
@@ -444,13 +444,14 @@
for (var i = 0; i < m; i++) {
this[i+n] = %_Arguments(i);
}
- this.length = n + m;
+ var new_length = n + m;
+ this.length = new_length;
} finally {
EndPerformSplice(this);
EnqueueSpliceRecord(this, n, [], m);
}
- return this.length;
+ return new_length;
}
// Appends the arguments to the end of the array and returns the new
@@ -471,8 +472,10 @@
for (var i = 0; i < m; i++) {
this[i+n] = %_Arguments(i);
}
- this.length = n + m;
- return this.length;
+
+ var new_length = n + m;
+ this.length = new_length;
+ return new_length;
}
@@ -627,13 +630,14 @@
for (var i = 0; i < num_arguments; i++) {
this[i] = %_Arguments(i);
}
- this.length = len + num_arguments;
+ var new_length = len + num_arguments;
+ this.length = new_length;
} finally {
EndPerformSplice(this);
EnqueueSpliceRecord(this, 0, [], num_arguments);
}
- return len + num_arguments;
+ return new_length;
}
function ArrayUnshift(arg1) { // length == 1
@@ -672,9 +676,9 @@
this[i] = %_Arguments(i);
}
- this.length = len + num_arguments;
-
- return this.length;
+ var new_length = len + num_arguments;
+ this.length = new_length;
+ return new_length;
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
