Array.prototype.{slice,splice} should use [[DefineOwnProperty]] to generate return value

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declarations have been made
 // in runtime.js:
 // var $Array = global.Array;
 
@@ skipping 267 matching lines @@
 // This is part of the old simple-minded splice.  We are using it either
 // because the receiver is not an array (so we have no choice) or because we
 // know we are not deleting or moving a lot of elements.
 function SimpleSlice(array, start_i, del_count, len, deleted_elements) {
   for (var i = 0; i < del_count; i++) {
     var index = start_i + i;
     // The spec could also be interpreted such that %HasOwnProperty
     // would be the appropriate test.  We follow KJS in consulting the
     // prototype.
     var current = array[index];
     if (!IS_UNDEFINED(current) || index in array) {

[Michael Starzinger, 2014/10/21 08:07:48]

I know this is not part of your change, but the ordering of the [[Get]] and
[[Has]] calls in this predicate is also off. It first loads the property and
then (if the value is undefined) checks presence of the property. The following
is a repro:

var a = [1, 2, 3];
Object.defineProperty(a, '1', {
  get: function() { delete this[1]; return undefined; },
  configurable: true
});
var s = a.slice(1);
assertTrue('0' in s);

-      deleted_elements[i] = current;
+      // The spec requires [[DefineOwnProperty]] here, %AddElement is close
+      // enough (in that it ignores the prototype).
+      %AddElement(deleted_elements, i, current, NONE);
     }
   }
 }
 
 
 function SimpleMove(array, start_i, del_count, len, num_additional_args) {
   if (num_additional_args !== del_count) {
     // Move the existing elements after the elements to be deleted
     // to the right position in the resulting array.
     if (num_additional_args > del_count) {
@@ skipping 1265 matching lines @@
   ));
 
   SetUpLockedPrototype(InternalPackedArray, $Array(), $Array(
     "join", getFunction("join", ArrayJoin),
     "pop", getFunction("pop", ArrayPop),
     "push", getFunction("push", ArrayPush)
   ));
 }
 
 SetUpArray();