Widen definition of %HasComplexElements() to include non-enumerability

This avoids using the Sparse methods on objects with non-enumerable elements,
which can cause the 'enumerable: false' bit to get lost in the operation.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/672323003

Cr-Commit-Position: refs/heads/master@{#24883}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 3d18e3d..81eec5e 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -15295,7 +15295,7 @@ bool Dictionary<Derived, Shape, Key>::HasComplexElements() {
       if (details.IsDeleted()) continue;
       if (details.type() == CALLBACKS) return true;
       PropertyAttributes attr = details.attributes();
-      if (attr & (READ_ONLY | DONT_DELETE)) return true;
+      if (attr & (READ_ONLY | DONT_DELETE | DONT_ENUM)) return true;
     }
   }
   return false;

diff --git a/src/objects.h b/src/objects.h
index be73a64..63c8d99 100644 (file)
--- a/src/objects.h
+++ b/src/objects.h
@@ -3551,7 +3551,7 @@ class Dictionary: public HashTable<Derived, Shape, Key> {
   int NumberOfEnumElements();
 
   // Returns true if the dictionary contains any elements that are non-writable,
-  // non-configurable, or have getters/setters.
+  // non-configurable, non-enumerable, or have getters/setters.
   bool HasComplexElements();
 
   enum SortMode { UNSORTED, SORTED };

diff --git a/test/mjsunit/regress/regress-shift-enumerable.js b/test/mjsunit/regress/regress-shift-enumerable.js
new file mode 100644 (file)
index 0000000..f3ee258
--- /dev/null
+++ b/test/mjsunit/regress/regress-shift-enumerable.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [1, 2];
+Object.defineProperty(arr, 0xfffe, {
+  value: 3,
+  configurable: true,
+  writable: true,
+  enumerable: false
+});
+arr[0xffff] = 4;
+arr.shift();
+var desc = Object.getOwnPropertyDescriptor(arr, 0xfffe);
+assertEquals(4, desc.value);
+assertFalse(desc.enumerable);