Version 3.25.28.6 (merged r20316, r20366, r20428, r20451)

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index a6d0403ab5d6dbaf86eb1d6ace19eab13928676a..45220ee29132ad21a02eaff02dfd15f7f37b8b5f 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -11376,6 +11376,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array,
   BeginPerformSplice(array);
 
   for (int i = 0; i < indices.length(); ++i) {
+    // For deletions where the property was an accessor, old_values[i]
+    // will be the hole, which instructs EnqueueChangeRecord to elide
+    // the "oldValue" property.
     JSObject::EnqueueChangeRecord(
         array, "delete", isolate->factory()->Uint32ToString(indices[i]),
         old_values[i]);
@@ -11392,6 +11395,9 @@ Handle<Object> JSArray::SetElementsLength(Handle<JSArray> array,
   Handle<JSArray> deleted = isolate->factory()->NewJSArray(0);
   if (delete_count > 0) {
     for (int i = indices.length() - 1; i >= 0; i--) {
+      // Skip deletions where the property was an accessor, leaving holes
+      // in the array of old values.
+      if (old_values[i]->IsTheHole()) continue;
       JSObject::SetElement(deleted, indices[i] - index, old_values[i], NONE,
                            SLOPPY);
     }