Index: src/objects.cc |
diff --git a/src/objects.cc b/src/objects.cc |
index c764b33e6793ee169d0866318e19483a888e4b08..55e3b810979d1fad9ad53b0035eb496f553d7562 100644 |
--- a/src/objects.cc |
+++ b/src/objects.cc |
@@ -11407,6 +11407,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array, |
BeginPerformSplice(array); |
for (int i = 0; i < indices.length(); ++i) { |
+ // For deletions where the property was an accessor, old_values[i] |
+ // will be the hole, which instructs EnqueueChangeRecord to elide |
+ // the "oldValue" property. |
JSObject::EnqueueChangeRecord( |
array, "delete", isolate->factory()->Uint32ToString(indices[i]), |
old_values[i]); |
@@ -11423,6 +11426,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array, |
Handle<JSArray> deleted = isolate->factory()->NewJSArray(0); |
if (delete_count > 0) { |
for (int i = indices.length() - 1; i >= 0; i--) { |
+ // Skip deletions where the property was an accessor, leaving holes |
+ // in the array of old values. |
+ if (old_values[i]->IsTheHole()) continue; |
JSObject::SetElement(deleted, indices[i] - index, old_values[i], NONE, |
SLOPPY); |
} |