Fix another corner case for DefineOwnProperty on arrays.

R=rossberg@chromium.org
BUG=v8:1756
TEST=test262

Review URL: http://codereview.chromium.org/8890015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/v8natives.js b/src/v8natives.js
index 61b130c..1d54e28 100644 (file)
--- a/src/v8natives.js
+++ b/src/v8natives.js
@@ -873,29 +873,33 @@ function DefineArrayProperty(obj, p, desc, should_throw) {
       throw new $RangeError('defineProperty() array length out of range');
     }
     var length_desc = GetOwnProperty(obj, "length");
+    if (new_length != length && !length_desc.isWritable()) {
+      if (should_throw) {
+        throw MakeTypeError("redefine_disallowed", [p]);
+      } else {
+        return false;
+      }
+    }
+    var threw = false;
+    while (new_length < length--) {
+      if (!Delete(obj, ToString(length), false)) {
+        new_length = length + 1;
+        threw = true;
+        break;
+      }
+    }
     // Make sure the below call to DefineObjectProperty() doesn't overwrite
     // any magic "length" property by removing the value.
+    obj.length = new_length;
     desc.value_ = void 0;
     desc.hasValue_ = false;
-    if ((new_length != length && !length_desc.isWritable()) ||
-        !DefineObjectProperty(obj, "length", desc, should_throw)) {
+    if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw) {
       if (should_throw) {
         throw MakeTypeError("redefine_disallowed", [p]);
       } else {
         return false;
       }
     }
-    obj.length = new_length;
-    while (new_length < length--) {
-      if (!Delete(obj, length, false)) {
-        obj.length = length + 1;
-        if (should_throw) {
-          throw MakeTypeError("redefine_disallowed", [p]);
-        } else {
-          return false;
-        }
-      }
-    }
     return true;
   }
 

diff --git a/test/test262/test262.status b/test/test262/test262.status
index 20955ac..c7d363d 100644 (file)
--- a/test/test262/test262.status
+++ b/test/test262/test262.status
@@ -43,13 +43,12 @@ S10.4.2.1_A1: FAIL
 S15.3.3.1_A4: FAIL
 
 # V8 Bug: http://code.google.com/p/v8/issues/detail?id=1756
-15.2.3.6-4-167: FAIL
-15.2.3.6-4-168: FAIL
-15.2.3.6-4-181: FAIL
-15.2.3.7-6-a-163: FAIL
-15.2.3.7-6-a-164: FAIL
+15.2.3.6-4-167: FAIL || PASS
+15.2.3.6-4-181: FAIL || PASS
+15.2.3.7-6-a-163: FAIL || PASS
+15.2.3.7-6-a-164: FAIL || PASS
 15.2.3.7-6-a-176: FAIL || PASS
-15.2.3.7-6-a-177: FAIL
+15.2.3.7-6-a-177: FAIL || PASS
 
 # V8 Bug: http://code.google.com/p/v8/issues/detail?id=1772
 15.2.3.6-4-292-1: FAIL