Reviewers: ulan (offline till April 1),
Message:
PTAL
Description:
Fix JSObject::SetElement for fixed typed array elements.
R=u...@chromium.org
BUG=357108
LOG=N
Please review this at https://codereview.chromium.org/214543003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+22, -1 lines):
M src/objects.cc
A test/mjsunit/regress/regress-357108.js
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
0013e720d48ea0f0389dc528feed442af8128bc3..a6d0403ab5d6dbaf86eb1d6ace19eab13928676a
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12410,7 +12410,8 @@ Handle<Object>
JSObject::SetElement(Handle<JSObject> object,
SetPropertyMode set_mode) {
Isolate* isolate = object->GetIsolate();
- if (object->HasExternalArrayElements()) {
+ if (object->HasExternalArrayElements() ||
+ object->HasFixedTypedArrayElements()) {
if (!value->IsNumber() && !value->IsUndefined()) {
bool has_exception;
Handle<Object> number =
Index: test/mjsunit/regress/regress-357108.js
diff --git a/test/mjsunit/regress/regress-357108.js
b/test/mjsunit/regress/regress-357108.js
new file mode 100644
index
0000000000000000000000000000000000000000..b20975b02b59c9e276bdeebbf63f97e102cf9e99
--- /dev/null
+++ b/test/mjsunit/regress/regress-357108.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+ function Check(a) {
+ a[0] = "";
+ assertEquals(0, a[0]);
+ a[0] = {};
+ assertEquals(0, a[0]);
+ a[0] = { valueOf : function() { return 27; } };
+ assertEquals(27, a[0]);
+ }
+ Check(new constructor(1));
+ Check(new constructor(100));
+}
+
+TestArray(Uint8Array);
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
