From: adamk@chromium.org <adamk@chromium.org>
Date: Mon, 27 Oct 2014 13:04:46 +0000 (+0000)
Subject: SimpleMove now calls [[Has]] before [[Get]] when moving elements
X-Git-Tag: upstream/4.7.83~6092
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f1954232b01a63690b415f20d3bd1f282682aa0f;p=platform%2Fupstream%2Fv8.git

SimpleMove now calls [[Has]] before [[Get]] when moving elements

BUG=v8:3643
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/678753002

Cr-Commit-Position: refs/heads/master@{#24907}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24907 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/array.js b/src/array.js
index 55dd797..29fa831 100644
--- a/src/array.js
+++ b/src/array.js
@@ -302,12 +302,8 @@ function SimpleMove(array, start_i, del_count, len, num_additional_args) {
       for (var i = len - del_count; i > start_i; i--) {
         var from_index = i + del_count - 1;
         var to_index = i + num_additional_args - 1;
-        // The spec could also be interpreted such that
-        // %HasOwnProperty would be the appropriate test.  We follow
-        // KJS in consulting the prototype.
-        var current = array[from_index];
-        if (!IS_UNDEFINED(current) || from_index in array) {
-          array[to_index] = current;
+        if (from_index in array) {
+          array[to_index] = array[from_index];
         } else {
           delete array[to_index];
         }
@@ -316,12 +312,8 @@ function SimpleMove(array, start_i, del_count, len, num_additional_args) {
       for (var i = start_i; i < len - del_count; i++) {
         var from_index = i + del_count;
         var to_index = i + num_additional_args;
-        // The spec could also be interpreted such that
-        // %HasOwnProperty would be the appropriate test.  We follow
-        // KJS in consulting the prototype.
-        var current = array[from_index];
-        if (!IS_UNDEFINED(current) || from_index in array) {
-          array[to_index] = current;
+        if (from_index in array) {
+          array[to_index] = array[from_index];
         } else {
           delete array[to_index];
         }
diff --git a/test/mjsunit/regress/regress-3643.js b/test/mjsunit/regress/regress-3643.js
index cc61a1c..bbc94fd 100644
--- a/test/mjsunit/regress/regress-3643.js
+++ b/test/mjsunit/regress/regress-3643.js
@@ -2,20 +2,29 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = [1, 2, 3];
-Object.defineProperty(a, '1', {
-  get: function() { delete this[1]; return undefined; },
-  configurable: true
-});
+function newArrayWithGetter() {
+  var arr = [1, 2, 3];
+  Object.defineProperty(arr, '1', {
+    get: function() { delete this[1]; return undefined; },
+    configurable: true
+  });
+  return arr;
+}
+
+var a = newArrayWithGetter();
 var s = a.slice(1);
 assertTrue('0' in s);
 
 // Sparse case should hit the same code as above due to presence of the getter.
-a = [1, 2, 3];
+a = newArrayWithGetter();
 a[0xffff] = 4;
-Object.defineProperty(a, '1', {
-  get: function() { delete this[1]; return undefined; },
-  configurable: true
-});
 s = a.slice(1);
 assertTrue('0' in s);
+
+a = newArrayWithGetter();
+a.shift();
+assertTrue('0' in a);
+
+a = newArrayWithGetter();
+a.unshift(0);
+assertTrue('2' in a);