Reviewers: mvstanton,
Message:
This just removes two of the bogus occurrences of Object.isSealed checks in
our
built-ins. In these two instances we behave correctly now that the array.js
file
is in strict mode. The "snafu" with the other built-ins will be addressed
later
once we can do it without regressing.
Description:
Fix bogus Object.isSealed check in some Array builtins.
R=mvstan...@chromium.org
Please review this at https://codereview.chromium.org/237253002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+16, -9 lines):
M src/array.js
A test/mjsunit/regress/regress-builtinbust-4.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
e23ecf3072e54799407cbdf2f80c25ceeeb8aeb9..2fa48b077a33c7a67f275028eb5fcbbf4726d660
100644
--- a/src/array.js
+++ b/src/array.js
@@ -463,10 +463,6 @@ function ArrayPush() {
var n = TO_UINT32(this.length);
var m = %_ArgumentsLength();
- if (m > 0 && ObjectIsSealed(this)) {
- throw MakeTypeError("array_functions_change_sealed",
- ["Array.prototype.push"]);
- }
if (%IsObserved(this))
return ObservedArrayPush.apply(this, arguments);
@@ -649,11 +645,6 @@ function ArrayUnshift(arg1) { // length == 1
var num_arguments = %_ArgumentsLength();
var is_sealed = ObjectIsSealed(this);
- if (num_arguments > 0 && is_sealed) {
- throw MakeTypeError("array_functions_change_sealed",
- ["Array.prototype.unshift"]);
- }
-
if (%IsObserved(this))
return ObservedArrayUnshift.apply(this, arguments);
Index: test/mjsunit/regress/regress-builtinbust-4.js
diff --git a/test/mjsunit/regress/regress-builtinbust-4.js
b/test/mjsunit/regress/regress-builtinbust-4.js
new file mode 100644
index
0000000000000000000000000000000000000000..dbaa2454daf3a6dcb71bd578e3c67226c81abc32
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-4.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { __proto__:Array.prototype, 0:"x" };
+function boomer() { return 0; }
+Object.defineProperty(o, "length", { get:boomer, set:boomer });
+Object.seal(o);
+
+assertDoesNotThrow(function() { o.push(1); });
+assertEquals(0, o.length);
+assertEquals(1, o[0]);
+
+assertDoesNotThrow(function() { o.unshift(2); });
+assertEquals(0, o.length);
+assertEquals(2, o[0]);
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
