From 4dd5bb2892db8cd08e84b636118cc3ce3acf4032 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Mon, 12 Dec 2011 10:20:46 +0000 Subject: [PATCH] Fix another corner case for DefineOwnProperty on arrays. R=rossberg@chromium.org BUG=v8:1756 TEST=test262 Review URL: http://codereview.chromium.org/8890015 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10236 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/v8natives.js | 30 +++++++++++++++++------------- test/test262/test262.status | 11 +++++------ 2 files changed, 22 insertions(+), 19 deletions(-) diff --git a/src/v8natives.js b/src/v8natives.js index 61b130c..1d54e28 100644 --- a/src/v8natives.js +++ b/src/v8natives.js @@ -873,29 +873,33 @@ function DefineArrayProperty(obj, p, desc, should_throw) { throw new $RangeError('defineProperty() array length out of range'); } var length_desc = GetOwnProperty(obj, "length"); + if (new_length != length && !length_desc.isWritable()) { + if (should_throw) { + throw MakeTypeError("redefine_disallowed", [p]); + } else { + return false; + } + } + var threw = false; + while (new_length < length--) { + if (!Delete(obj, ToString(length), false)) { + new_length = length + 1; + threw = true; + break; + } + } // Make sure the below call to DefineObjectProperty() doesn't overwrite // any magic "length" property by removing the value. + obj.length = new_length; desc.value_ = void 0; desc.hasValue_ = false; - if ((new_length != length && !length_desc.isWritable()) || - !DefineObjectProperty(obj, "length", desc, should_throw)) { + if (!DefineObjectProperty(obj, "length", desc, should_throw) || threw) { if (should_throw) { throw MakeTypeError("redefine_disallowed", [p]); } else { return false; } } - obj.length = new_length; - while (new_length < length--) { - if (!Delete(obj, length, false)) { - obj.length = length + 1; - if (should_throw) { - throw MakeTypeError("redefine_disallowed", [p]); - } else { - return false; - } - } - } return true; } diff --git a/test/test262/test262.status b/test/test262/test262.status index 20955ac..c7d363d 100644 --- a/test/test262/test262.status +++ b/test/test262/test262.status @@ -43,13 +43,12 @@ S10.4.2.1_A1: FAIL S15.3.3.1_A4: FAIL # V8 Bug: http://code.google.com/p/v8/issues/detail?id=1756 -15.2.3.6-4-167: FAIL -15.2.3.6-4-168: FAIL -15.2.3.6-4-181: FAIL -15.2.3.7-6-a-163: FAIL -15.2.3.7-6-a-164: FAIL +15.2.3.6-4-167: FAIL || PASS +15.2.3.6-4-181: FAIL || PASS +15.2.3.7-6-a-163: FAIL || PASS +15.2.3.7-6-a-164: FAIL || PASS 15.2.3.7-6-a-176: FAIL || PASS -15.2.3.7-6-a-177: FAIL +15.2.3.7-6-a-177: FAIL || PASS # V8 Bug: http://code.google.com/p/v8/issues/detail?id=1772 15.2.3.6-4-292-1: FAIL -- 2.7.4