Fix bogus call to Object.hasOwnProperty in Array builtin.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-builtinbust-5

Review URL: https://codereview.chromium.org/239033002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@20766 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent 1a44233c
......@@ -651,17 +651,6 @@ function ArrayUnshift(arg1) { // length == 1
if (IS_ARRAY(this) && !is_sealed) {
SmartMove(this, 0, 0, len, num_arguments);
} else {
if (num_arguments == 0 && ObjectIsFrozen(this)) {
// In the zero argument case, values from the prototype come into the
// object. This can't be allowed on frozen arrays.
for (var i = 0; i < len; i++) {
if (!this.hasOwnProperty(i) && !IS_UNDEFINED(this[i])) {
throw MakeTypeError("array_functions_on_frozen",
["Array.prototype.shift"]);
}
}
}
SimpleMove(this, 0, 0, len, num_arguments);
}
......
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
var a = [ 1, 2, 3 ];
var was_called = false;
function poison() { was_called = true; }
a.hasOwnProperty = poison;
Object.freeze(a);
assertThrows("a.unshift()", TypeError);
assertEquals(3, a.length);
assertFalse(was_called);
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment