Properly process arrays with overridden prototype in various Array's functions.
authorantonm@chromium.org <antonm@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Wed, 12 May 2010 12:22:09 +0000 (12:22 +0000)
committerantonm@chromium.org <antonm@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Wed, 12 May 2010 12:22:09 +0000 (12:22 +0000)
commite8e35eccac57ce9f732498eb7c9f9de7b6478365
tree42f0a307d8039189a6e149b9aa97aaaa23169650
parent44fb6cc8d3cdfb3bc637c37cc9a9e5c4b985688f
Properly process arrays with overridden prototype in various Array's functions.

Bailout to JS Array builtins if array's prototype is different from
Array.prototype.  Otherwise there might be inherited elements coming
from this prototype.

Review URL: http://codereview.chromium.org/2037008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/builtins.cc
test/mjsunit/array-concat.js
test/mjsunit/array-pop.js
test/mjsunit/array-shift.js
test/mjsunit/array-slice.js
test/mjsunit/array-splice.js
test/mjsunit/array-unshift.js