From 8535c6484db0f73dd5a4e0a2cabb3b0a978e103b Mon Sep 17 00:00:00 2001 From: "verwaest@chromium.org" Date: Thu, 15 Nov 2012 14:30:01 +0000 Subject: [PATCH] Set length only after retrieving the element succeeded Review URL: https://chromiumcodereview.appspot.com/11417006 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12974 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/builtins.cc | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/builtins.cc b/src/builtins.cc index 6617fe1..1ef5ab6 100644 --- a/src/builtins.cc +++ b/src/builtins.cc @@ -673,14 +673,17 @@ BUILTIN(ArrayPop) { ElementsAccessor* accessor = array->GetElementsAccessor(); int new_length = len - 1; - Object* result; - MaybeObject* maybe_result = accessor->Get(array, array, new_length); - if (!maybe_result->To(&result)) return maybe_result; + MaybeObject* maybe_result; + if (accessor->HasElement(array, array, new_length, elms_obj)) { + maybe_result = accessor->Get(array, array, new_length, elms_obj); + } else { + maybe_result = array->GetPrototype()->GetElement(len - 1); + } + if (maybe_result->IsFailure()) return maybe_result; MaybeObject* maybe_failure = accessor->SetLength(array, Smi::FromInt(new_length)); if (maybe_failure->IsFailure()) return maybe_failure; - if (!result->IsTheHole()) return result; - return array->GetPrototype()->GetElement(len - 1); + return maybe_result; } -- 2.7.4