Fix bogus Object.isSealed check in some Array builtins.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/237253002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20750 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/array.js b/src/array.js
index e23ecf3..2fa48b0 100644 (file)
--- a/src/array.js
+++ b/src/array.js
@@ -463,10 +463,6 @@ function ArrayPush() {
 
   var n = TO_UINT32(this.length);
   var m = %_ArgumentsLength();
-  if (m > 0 && ObjectIsSealed(this)) {
-    throw MakeTypeError("array_functions_change_sealed",
-                        ["Array.prototype.push"]);
-  }
 
   if (%IsObserved(this))
     return ObservedArrayPush.apply(this, arguments);
@@ -649,11 +645,6 @@ function ArrayUnshift(arg1) {  // length == 1
   var num_arguments = %_ArgumentsLength();
   var is_sealed = ObjectIsSealed(this);
 
-  if (num_arguments > 0 && is_sealed) {
-    throw MakeTypeError("array_functions_change_sealed",
-                        ["Array.prototype.unshift"]);
-  }
-
   if (%IsObserved(this))
     return ObservedArrayUnshift.apply(this, arguments);
 

diff --git a/test/mjsunit/regress/regress-builtinbust-4.js b/test/mjsunit/regress/regress-builtinbust-4.js
new file mode 100644 (file)
index 0000000..dbaa245
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-4.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { __proto__:Array.prototype, 0:"x" };
+function boomer() { return 0; }
+Object.defineProperty(o, "length", { get:boomer, set:boomer });
+Object.seal(o);
+
+assertDoesNotThrow(function() { o.push(1); });
+assertEquals(0, o.length);
+assertEquals(1, o[0]);
+
+assertDoesNotThrow(function() { o.unshift(2); });
+assertEquals(0, o.length);
+assertEquals(2, o[0]);