Reviewers: mvstanton,
Message:
Now that array.js is in strict mode, we can get rid of the Object.isFrozen
check
in Array.prototype.unshift and at the same time fix a bogus call to
Object.hasOwnProperty as well.
Description:
Fix bogus call to Object.hasOwnProperty in Array builtin.
[email protected]
TEST=mjsunit/regress/regress-builtinbust-5
Please review this at https://codereview.chromium.org/239033002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+13, -11 lines):
M src/array.js
A test/mjsunit/regress/regress-builtinbust-5.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
2fa48b077a33c7a67f275028eb5fcbbf4726d660..ea4f3b41cb8949e666d9ede4cea1ed629f60a7af
100644
--- a/src/array.js
+++ b/src/array.js
@@ -651,17 +651,6 @@ function ArrayUnshift(arg1) { // length == 1
if (IS_ARRAY(this) && !is_sealed) {
SmartMove(this, 0, 0, len, num_arguments);
} else {
- if (num_arguments == 0 && ObjectIsFrozen(this)) {
- // In the zero argument case, values from the prototype come into the
- // object. This can't be allowed on frozen arrays.
- for (var i = 0; i < len; i++) {
- if (!this.hasOwnProperty(i) && !IS_UNDEFINED(this[i])) {
- throw MakeTypeError("array_functions_on_frozen",
- ["Array.prototype.shift"]);
- }
- }
- }
-
SimpleMove(this, 0, 0, len, num_arguments);
}
Index: test/mjsunit/regress/regress-builtinbust-5.js
diff --git a/test/mjsunit/regress/regress-builtinbust-5.js
b/test/mjsunit/regress/regress-builtinbust-5.js
new file mode 100644
index
0000000000000000000000000000000000000000..266e4d48bd23732107a383ed3b25bdb1ad3be050
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-5.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [ 1, 2, 3 ];
+var was_called = false;
+function poison() { was_called = true; }
+a.hasOwnProperty = poison;
+Object.freeze(a);
+
+assertThrows("a.unshift()", TypeError);
+assertEquals(3, a.length);
+assertFalse(was_called);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
