Revision: 12974 Author: [email protected] Date: Thu Nov 15 06:30:01 2012 Log: Set length only after retrieving the element succeeded
Review URL: https://chromiumcodereview.appspot.com/11417006 http://code.google.com/p/v8/source/detail?r=12974 Modified: /branches/bleeding_edge/src/builtins.cc ======================================= --- /branches/bleeding_edge/src/builtins.cc Thu Nov 15 04:19:14 2012 +++ /branches/bleeding_edge/src/builtins.cc Thu Nov 15 06:30:01 2012 @@ -673,14 +673,17 @@ ElementsAccessor* accessor = array->GetElementsAccessor(); int new_length = len - 1; - Object* result; - MaybeObject* maybe_result = accessor->Get(array, array, new_length); - if (!maybe_result->To(&result)) return maybe_result; + MaybeObject* maybe_result; + if (accessor->HasElement(array, array, new_length, elms_obj)) { + maybe_result = accessor->Get(array, array, new_length, elms_obj); + } else { + maybe_result = array->GetPrototype()->GetElement(len - 1); + } + if (maybe_result->IsFailure()) return maybe_result; MaybeObject* maybe_failure = accessor->SetLength(array, Smi::FromInt(new_length)); if (maybe_failure->IsFailure()) return maybe_failure; - if (!result->IsTheHole()) return result; - return array->GetPrototype()->GetElement(len - 1); + return maybe_result; } -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
