Fix return value of push() and unshift() on Array.prototype.

R=ulan@chromium.org
TEST=mjsunit/regress/regress-builtinbust-3

Review URL: https://codereview.chromium.org/230453002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20602 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/array.js b/src/array.js
index d158a059c678019ef2460f142eabc2e252ef4754..b3b25ed260c505f35c058c0cdabd8e8b9b8c057c 100644 (file)
--- a/src/array.js
+++ b/src/array.js
@@ -444,13 +444,14 @@ function ObservedArrayPush() {
     for (var i = 0; i < m; i++) {
       this[i+n] = %_Arguments(i);
     }
-    this.length = n + m;
+    var new_length = n + m;
+    this.length = new_length;
   } finally {
     EndPerformSplice(this);
     EnqueueSpliceRecord(this, n, [], m);
   }
 
-  return this.length;
+  return new_length;
 }
 
 // Appends the arguments to the end of the array and returns the new
@@ -471,8 +472,10 @@ function ArrayPush() {
   for (var i = 0; i < m; i++) {
     this[i+n] = %_Arguments(i);
   }
-  this.length = n + m;
-  return this.length;
+
+  var new_length = n + m;
+  this.length = new_length;
+  return new_length;
 }
 
 
@@ -627,13 +630,14 @@ function ObservedArrayUnshift() {
     for (var i = 0; i < num_arguments; i++) {
       this[i] = %_Arguments(i);
     }
-    this.length = len + num_arguments;
+    var new_length = len + num_arguments;
+    this.length = new_length;
   } finally {
     EndPerformSplice(this);
     EnqueueSpliceRecord(this, 0, [], num_arguments);
   }
 
-  return len + num_arguments;
+  return new_length;
 }
 
 function ArrayUnshift(arg1) {  // length == 1
@@ -672,9 +676,9 @@ function ArrayUnshift(arg1) {  // length == 1
     this[i] = %_Arguments(i);
   }
 
-  this.length = len + num_arguments;
-
-  return this.length;
+  var new_length = len + num_arguments;
+  this.length = new_length;
+  return new_length;
 }
 
 

diff --git a/test/mjsunit/regress/regress-builtinbust-3.js b/test/mjsunit/regress/regress-builtinbust-3.js
new file mode 100644 (file)
index 0000000..f5a0c39
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-3.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function produce_object() {
+  var real_length = 1;
+  function set_length() { real_length = "boom"; }
+  function get_length() { return real_length; }
+  var o = { __proto__:Array.prototype , 0:"x" };
+  Object.defineProperty(o, "length", { set:set_length, get:get_length })
+  return o;
+}
+
+assertEquals(2, produce_object().push("y"));
+assertEquals(2, produce_object().unshift("y"));