When notifying observers of a truncated array, don't call getters on deleted element...

BUG=v8:2409

Review URL: https://codereview.chromium.org/11414177

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13110 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 324b10c..d444355 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9439,8 +9439,10 @@ MaybeObject* JSArray::SetElementsLength(Object* len) {
     // A non-configurable property will cause the truncation operation to
     // stop at this index.
     if (attributes == DONT_DELETE) break;
-    // TODO(adamk): Don't fetch the old value if it's an accessor.
-    old_values.Add(Object::GetElement(self, i));
+    old_values.Add(
+        self->GetLocalElementAccessorPair(i) == NULL
+        ? Object::GetElement(self, i)
+        : Handle<Object>::cast(isolate->factory()->the_hole_value()));
     indices.Add(isolate->factory()->Uint32ToString(i));
   }
 

diff --git a/test/mjsunit/harmony/object-observe.js b/test/mjsunit/harmony/object-observe.js
index 474bfcd..d88c24e 100644 (file)
--- a/test/mjsunit/harmony/object-observe.js
+++ b/test/mjsunit/harmony/object-observe.js
@@ -584,8 +584,7 @@ Object.defineProperty(arr3, 'length', {value: 10, writable: false});
 Object.deliverChangeRecords(observer.callback);
 observer.assertCallbackRecords([
   { object: arr, name: '3', type: 'deleted', oldValue: 'd' },
-  // TODO(adamk): oldValue should not be present below
-  { object: arr, name: '2', type: 'deleted', oldValue: undefined },
+  { object: arr, name: '2', type: 'deleted' },
   { object: arr, name: 'length', type: 'updated', oldValue: 4 },
   { object: arr, name: '1', type: 'deleted', oldValue: 'b' },
   { object: arr, name: 'length', type: 'updated', oldValue: 2 },