137181 - delete on an arguments[i] not working correctly

Status: VERIFIED FIXED

(Rhino Graveyard :: Core, defect)

Description

[Phil Schwartau]

Reported in the JS Engine newsgroup by [e-mail] (Igor Bukanov):

"Given the following and my reading of Ecma-262

function test1(x) {
    x = 1;
    delete arguments[0];
    return x;
}

function test2(x) {
    x = 1;
    delete arguments[0];
    arguments[0] = -1;
    return x;
}


test1(0) and test2(0) should both return 1, since after |delete argument[0]|,
arguments[0] loses any connection with x, even if arguments[0] is recreated. 


From ECMA-262 Edition 3:


Section 10.1.8 Arguments Object

*  For each non-negative integer, arg, less than the value of the length
property, a property is created with name ToString(arg) and property
attributes { DontEnum }. The initial value of this property is the value 
of the corresponding actual parameter supplied by the caller. The first 
actual parameter value corresponds to arg = 0, the second to arg = 1, 
and so on. In the case when arg is less than the number of formal 
parameters for the Function object, this property shares its value with 
the corresponding property of the activation object. This means that 
changing this property changes the corresponding property of the 
activation object and vice versa.


Section 10.2.3 Function Code

*  Variable instantiation is performed using the activation object as 
the variable object and using property attributes { DontDelete }.


SpiderMonkey meets these expectations, but Rhino does not.
In Rhino, test1(0) returns |undefined|; test2(0) returns -1.


Note the testcase for bug 72884,

     mozilla/js/tests/ecma_3/Function/arguments-001.js

does not touch this area, so maybe it should be updated to
cover this issue as well -"



FOR REFERENCE:

bug 72884 (SpiderMonkey) "Arguments object has incorrect [[Prototype]] property"
bug 79568 (Rhino)        "delete on an arguments[i] not working correctly"

Comment 1

[Phil Schwartau]

Igor's test has been added to the JS testsuite:

          mozilla/js/tests/ecma_3/Function/regress-137181.js


Currently passing in SpiderMonkey, failing in Rhino:

FAILED!: Section 1 of test -
FAILED!: Expected value '1', Actual value 'undefined'

FAILED!: Section 2 of test -
FAILED!: Expected value '1', Actual value '-1'

Comment 2

[Igor Bukanov]

Attachment: Code fix: patch to omj/Arguments.java

The patch uses the special NOT_FOUND value to flag deleted indexes. It also
make sure that original array object passed to Function.call is not modified,
as all changes goes to cloned copy. It is not necessary for the fix, but it is
the only place in the current Rhino that can alter Object[] array passed to
Function.call and I think it is better to remove this exceptional case.

I will run the tests and if there are no objections will commit it in couple
days.

Comment 3

[Igor Bukanov]

Attachment: Fixing comments misspells in the previous patch version

Comment 4

[Igor Bukanov]

I committed the fix so Rhino passes the additional tests.

Comment 5

[Igor Bukanov]

As this is in Rhino CVS for a long time now, maybe it can be marked fixed/verified?

Comment 6

[Phil Schwartau]

Igor is correct - marking FIXED

Comment 7

[Phil Schwartau]

Marking Verified Fixed.

Igor's testcase now passes in both the rhino and rhinoi shells -

Comment 8

[Igor Bukanov]

Targeting as resolved against 1.5R4