Fix bug in deletion of indexed properties

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 7dcefa2da6c4643ccdda8f8ce4ec76b27d33fb21..3ac771d39bbef459d958b55917af93d29d2827f2 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3943,6 +3943,21 @@ MaybeObject* JSObject::DeleteProperty(String* name, DeleteMode mode) {
     return isolate->heap()->false_value();
   }
 
+  if (IsStringObjectWithCharacterAt(index)) {

[Michael Starzinger, 2012/10/15 15:20:39]

This was moved from DeleteElement() to DeleteProperty(), I guess that was an
accident and I'll move it back.

[Peter Varga, 2012/10/15 15:25:34]

This is on purpose. Based on ECMA standard it should throw an exception in
strict mode.

[Michael Starzinger, 2012/10/15 15:30:19]

I totally agree but that wasn't the point of my comment. My comment is about
this being in JSObject::DeleteProperty() where we didn't yet convert the
property name into an index. That happens further down and the call is delegated
to JSObject::DeleteElement() in those cases. It only makes sense to check
whether we are accessing a character in a string after that point. Also it just
doesn't compile here! :)

[Peter Varga, 2012/10/15 15:48:23]

I see the problem now. It seems git applied the patch wrongly.

+    if (mode == STRICT_DELETION) {
+      // Deleting a non-configurable property in strict mode.
+      HandleScope scope(isolate);
+      Handle<Object> holder(this);
+      Handle<Object> name = isolate->factory()->NewNumberFromUint(index);
+      Handle<Object> args[2] = { name, holder };
+      Handle<Object> error =
+          isolate->factory()->NewTypeError("strict_delete_property",
+                                           HandleVector(args, 2));
+      return isolate->Throw(*error);
+    }
+    return isolate->heap()->false_value();
+  }
+
   if (IsJSGlobalProxy()) {
     Object* proto = GetPrototype();
     if (proto->IsNull()) return isolate->heap()->false_value();