From: mstarzinger@chromium.org <mstarzinger@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Wed, 19 Oct 2011 13:56:18 +0000 (+0000)
Subject: Fix handling Function.apply for non-array arguments.
X-Git-Tag: upstream/4.7.83~18152
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=67c9a03922cbbc31506f276e8b6ac0b476c2ca02;p=platform%2Fupstream%2Fv8.git

Fix handling Function.apply for non-array arguments.

R=rossberg@chromium.org
TEST=mjsunit/apply,test262

Review URL: http://codereview.chromium.org/8342034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/runtime.js b/src/runtime.js
index c3554c6..b6fe69d 100644
--- a/src/runtime.js
+++ b/src/runtime.js
@@ -469,7 +469,7 @@ function APPLY_PREPARE(args) {
   }
 
   // Make sure the arguments list has the right type.
-  if (args != null && !IS_ARRAY(args) && !IS_ARGUMENTS(args)) {
+  if (args != null && !IS_SPEC_OBJECT(args)) {
     throw %MakeTypeError('apply_wrong_args', []);
   }
 
diff --git a/test/mjsunit/apply.js b/test/mjsunit/apply.js
index c166110..413ee93 100644
--- a/test/mjsunit/apply.js
+++ b/test/mjsunit/apply.js
@@ -190,3 +190,10 @@ assertEquals("morseper",
     "moreseper-prime");
 
 delete(Array.prototype["1"]);
+
+// Check correct handling of non-array argument lists.
+assertSame(this, f0.apply(this, {}), "non-array-1");
+assertSame(this, f0.apply(this, { length:1 }), "non-array-2");
+assertEquals(void 0, f1.apply(this, { length:1 }), "non-array-3");
+assertEquals(void 0, f1.apply(this, { 0:"foo" }), "non-array-4");
+assertEquals("foo", f1.apply(this, { length:1, 0:"foo" }), "non-array-5");
diff --git a/test/test262/test262.status b/test/test262/test262.status
index 29d113e..2ba0f15 100644
--- a/test/test262/test262.status
+++ b/test/test262/test262.status
@@ -448,15 +448,6 @@ S15.4.4.3_A2_T1: FAIL_OK
 #      'P' which is defined as non-configurable (10.6 [[DefineOwnProperty]] step
 #      4)
 15.2.3.7-6-a-285: FAIL
-# Bug? Strict Mode - 'this' value is a string which cannot be converted to
-#      wrapper objects when the function is called with an array of arguments
-15.3.4.3-1-s: FAIL
-# Bug? Strict Mode - 'this' value is a number which cannot be converted to
-#      wrapper objects when the function is called with an array of arguments
-15.3.4.3-2-s: FAIL
-# Bug? Strict Mode - 'this' value is a boolean which cannot be converted to
-#      wrapper objects when the function is called with an array of arguments
-15.3.4.3-3-s: FAIL
 # Bug? Array.prototype.indexOf - decreasing length of array does not delete
 #      non-configurable properties
 15.4.4.14-9-a-19: FAIL