Revision: 9881
Author: [email protected]
Date: Fri Nov 4 05:31:44 2011
Log: Fix JSObject::EnsureCanContainElements to correctly iterate over
Arguments
TEST=mjsunit/elements-kind.js
Review URL: http://codereview.chromium.org/8437094
http://code.google.com/p/v8/source/detail?r=9881
Modified:
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/test/mjsunit/elements-kind.js
=======================================
--- /branches/bleeding_edge/src/objects.cc Thu Nov 3 07:17:05 2011
+++ /branches/bleeding_edge/src/objects.cc Fri Nov 4 05:31:44 2011
@@ -8743,7 +8743,12 @@
MaybeObject* JSObject::EnsureCanContainElements(Arguments* args,
uint32_t first_arg,
uint32_t arg_count) {
- return EnsureCanContainElements(args->arguments() - first_arg,
arg_count);
+ // Elements in |Arguments| are ordered backwards (because they're on the
+ // stack), but the method that's called here iterates over them in
forward
+ // direction.
+ return EnsureCanContainElements(
+ args->arguments() - first_arg - (arg_count - 1),
+ arg_count);
}
=======================================
--- /branches/bleeding_edge/test/mjsunit/elements-kind.js Fri Nov 4
05:19:35 2011
+++ /branches/bleeding_edge/test/mjsunit/elements-kind.js Fri Nov 4
05:31:44 2011
@@ -316,6 +316,15 @@
// TODO(1810): Change implementation so that we get DOUBLE elements here?
assertKind(elements_kind.fast, c);
}
+
+// Test that Array.push() correctly handles SMI elements.
+if (support_smi_only_arrays) {
+ var a = [1, 2];
+ assertKind(elements_kind.fast_smi_only, a);
+ a.push(3, 4, 5);
+ assertKind(elements_kind.fast_smi_only, a);
+ assertEquals([1, 2, 3, 4, 5], a);
+}
// Throw away type information in the ICs for next stress run.
gc();
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
