Merge V8 at branches/3.2 r8606: Initial merge by Git.
Change-Id: I9906d4a1145c7fab2ad78e7a9c375205c56d1287
diff --git a/src/accessors.cc b/src/accessors.cc
index 5f9bf74..7fa6982 100644
--- a/src/accessors.cc
+++ b/src/accessors.cc
@@ -101,6 +101,15 @@
MaybeObject* Accessors::ArraySetLength(JSObject* object, Object* value, void*) {
Isolate* isolate = object->GetIsolate();
+
+ // This means one of the object's prototypes is a JSArray and the
+ // object does not have a 'length' property. Calling SetProperty
+ // causes an infinite loop.
+ if (!object->IsJSArray()) {
+ return object->SetLocalPropertyIgnoreAttributes(
+ isolate->heap()->length_symbol(), value, NONE);
+ }
+
value = FlattenNumber(value);
// Need to call methods that may trigger GC.
@@ -116,20 +125,8 @@
Handle<Object> number_v = Execution::ToNumber(value_handle, &has_exception);
if (has_exception) return Failure::Exception();
- // Restore raw pointers,
- object = *object_handle;
- value = *value_handle;
-
if (uint32_v->Number() == number_v->Number()) {
- if (object->IsJSArray()) {
- return JSArray::cast(object)->SetElementsLength(*uint32_v);
- } else {
- // This means one of the object's prototypes is a JSArray and
- // the object does not have a 'length' property.
- // Calling SetProperty causes an infinite loop.
- return object->SetLocalPropertyIgnoreAttributes(
- isolate->heap()->length_symbol(), value, NONE);
- }
+ return Handle<JSArray>::cast(object_handle)->SetElementsLength(*uint32_v);
}
return isolate->Throw(
*isolate->factory()->NewRangeError("invalid_array_length",