Properly process arrays with overridden prototype in various Array's functions.

Properly process arrays with overridden prototype in various Array's functions.

Bailout to JS Array builtins if array's prototype is different from
Array.prototype.  Otherwise there might be inherited elements coming
from this prototype.

Committed: http://code.google.com/p/v8/source/detail?r=4649

[antonm, 2010-05-12 11:23:03]

Lasse, Mads,

may you have a look?

[Mads Ager (chromium), 2010-05-12 11:36:25]

LGTM

Thanks for the thorough updating of the tests!

http://codereview.chromium.org/2037008/diff/2001/3001
File src/builtins.cc (right):

http://codereview.chromium.org/2037008/diff/2001/3001#newcode333
src/builtins.cc:333: static JSObject* ArrayPrototype(Context* global_context) {
Is this function worth it? There seems to be only two calls to it?

http://codereview.chromium.org/2037008/diff/2001/3006
File test/mjsunit/array-splice.js (right):

http://codereview.chromium.org/2037008/diff/2001/3006#newcode293
test/mjsunit/array-splice.js:293: assertFalse(array.hasOwnProperty(2 << 32 - 1),
"array.hasOwnProperty(2 << 31 - 1)");
Long line.

http://codereview.chromium.org/2037008/diff/2001/3007
File test/mjsunit/array-unshift.js (right):

http://codereview.chromium.org/2037008/diff/2001/3007#newcode118
test/mjsunit/array-unshift.js:118: // Check that unshif with no args has a
side-effect of
unshif -> unshift

http://codereview.chromium.org/2037008/diff/2001/3007#newcode119
test/mjsunit/array-unshift.js:119: // feeling the holes with elements from the
prototype
feeling -> filling

[antonm, 2010-05-12 12:15:24]

Thanks a lot for review, Mads.

Lasse, I'm going to submit it now.  If you have any concerns, I'd address them
in a separate CL.

http://codereview.chromium.org/2037008/diff/2001/3001
File src/builtins.cc (right):

http://codereview.chromium.org/2037008/diff/2001/3001#newcode333
src/builtins.cc:333: static JSObject* ArrayPrototype(Context* global_context) {
On 2010/05/12 11:36:25, Mads Ager wrote:
> Is this function worth it? There seems to be only two calls to it?

Just hate duplicating the code :)  NP, inlining it.

http://codereview.chromium.org/2037008/diff/2001/3006
File test/mjsunit/array-splice.js (right):

http://codereview.chromium.org/2037008/diff/2001/3006#newcode293
test/mjsunit/array-splice.js:293: assertFalse(array.hasOwnProperty(2 << 32 - 1),
"array.hasOwnProperty(2 << 31 - 1)");
On 2010/05/12 11:36:25, Mads Ager wrote:
> Long line.

Done.

http://codereview.chromium.org/2037008/diff/2001/3007
File test/mjsunit/array-unshift.js (right):

http://codereview.chromium.org/2037008/diff/2001/3007#newcode118
test/mjsunit/array-unshift.js:118: // Check that unshif with no args has a
side-effect of
On 2010/05/12 11:36:25, Mads Ager wrote:
> unshif -> unshift

Done.

http://codereview.chromium.org/2037008/diff/2001/3007#newcode119
test/mjsunit/array-unshift.js:119: // feeling the holes with elements from the
prototype
On 2010/05/12 11:36:25, Mads Ager wrote:
> feeling -> filling

Done.