Skip to content

Commit

Permalink
Avoid accessing arguments array without length check.
Browse files Browse the repository at this point in the history
Accessing elements after the end of the arguments array triggers
deoptimization of the entire function on v8, so avoid doing so.  Also
tweak all the checks into the same standard form for consistency.
  • Loading branch information
cscott committed Dec 16, 2015
1 parent 8dc13d7 commit 859f415
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions es6-shim.js
Original file line number Diff line number Diff line change
Expand Up @@ -1096,7 +1096,9 @@

var ArrayPrototypeShims = {
copyWithin: function copyWithin(target, start) {
var end = arguments[2]; // copyWithin.length must be 2
// copyWithin.length must be 2, so we can't add `end` to the arguments
// directly.
var end = arguments.length > 2 ? arguments[2] : void 0;
var o = ES.ToObject(this);
var len = ES.ToLength(o.length);
var relativeTarget = ES.ToInteger(target);
Expand Down Expand Up @@ -1243,7 +1245,7 @@
if (!arrayFromHandlesUndefinedMapFunction) {
var origArrayFrom = Array.from;
overrideNative(Array, 'from', function from(items) {
if (arguments.length > 0 && typeof arguments[1] !== 'undefined') {
if (arguments.length > 1 && typeof arguments[1] !== 'undefined') {
return ES.Call(origArrayFrom, this, arguments);
} else {
return _call(origArrayFrom, this, items);
Expand Down Expand Up @@ -2442,7 +2444,7 @@
if (!ES.IsPromise(promise)) { throw new TypeError('not a promise'); }
var C = ES.SpeciesConstructor(promise, Promise);
var resultCapability;
var returnValueIsIgnored = (arguments[2] === PROMISE_FAKE_CAPABILITY);
var returnValueIsIgnored = (arguments.length > 2 && arguments[2] === PROMISE_FAKE_CAPABILITY);
if (returnValueIsIgnored && C === Promise) {
resultCapability = PROMISE_FAKE_CAPABILITY;
} else {
Expand Down Expand Up @@ -3302,7 +3304,7 @@
if (!ES.IsConstructor(constructor)) {
throw new TypeError('First argument must be a constructor.');
}
var newTarget = arguments.length < 3 ? constructor : arguments[2];
var newTarget = arguments.length > 2 ? arguments[2] : constructor;
if (!ES.IsConstructor(newTarget)) {
throw new TypeError('new.target must be a constructor.');
}
Expand Down

0 comments on commit 859f415

Please sign in to comment.