Commit 7b011fc9 authored by adamk's avatar adamk Committed by Commit bot

Array splice should only normalize deleted_elements if it's an array

Also slightly expand regression test to end with a return instead of
an exception.

R=cbruni@chromium.org
BUG=chromium:618788

Review-Url: https://codereview.chromium.org/2090193002
Cr-Commit-Position: refs/heads/master@{#37223}
parent 4f674da2
......@@ -729,7 +729,7 @@ function ArraySplice(start, delete_count) {
}
if (UseSparseVariant(array, len, IS_ARRAY(array), changed_elements)) {
%NormalizeElements(array);
%NormalizeElements(deleted_elements);
if (IS_ARRAY(deleted_elements)) %NormalizeElements(deleted_elements);
SparseSlice(array, start_i, del_count, len, deleted_elements);
SparseMove(array, start_i, del_count, len, num_elements_to_add);
} else {
......
......@@ -2,7 +2,20 @@
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertThrows(() => a.slice());
// Slice and splice both try to set the length property of their return
// value. Add a bogus setter to allow that.
Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
(function testSlice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.slice() instanceof Int32Array);
})();
(function testSplice() {
var a = new Array();
a.constructor = Int32Array;
a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
assertTrue(a.splice(1) instanceof Int32Array);
})();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment