612260 - Classes extending Array don't work

Status: RESOLVED DUPLICATE of bug 599159

(Core :: JavaScript Engine, defect)

Description

[T. Brains]

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)
Build Identifier: 4.0b7

A subclass of Array stops reporting the right length when an additional method is added to its prototype.

This is a regression in 4.0b7, and is confirmed to work as expected in 4.0b6 and 3.5.

Reproducible: Always

Steps to Reproduce:
Use the following code:

  function MyArray() {}
  MyArray.prototype=new Array();
  MyArray.prototype.item=function (x) { return this[x]; }

  var arr=new MyArray();
  arr.push("foo");
  alert(arr.length);

Actual Results:  
Alerts 0 in 4.0b7, alerts 1 in 4.0b6 and 3.5.

Expected Results:  
Should alert 1.

Comment 1

[T. Brains]

Sorry, I meant 3.6 in the original report. Confirmed to be working as expected in 3.6.12, 3.5.13, 3.0.19 and 2.0.0.20.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Due to skipped revisions, the first bad revision could be any of:
changeset:   53606:a55097cd48d8
user:        Jim Blandy <[e-mail]>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Use ObjectOps::setProperty for both fast and slow arrays. r=brendan

changeset:   53607:8f7761878ba5
user:        Jim Blandy <[e-mail]>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Tests for strict mode assignments to read-only properties, deletions of non-configurable properties. r=jorendorff

changeset:   53608:9cfceee11abd
user:        Jim Blandy <[e-mail]>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Delete unused property operation typedefs: JSDefinePropOp, JSPropertyIdOp. r=luke

changeset:   53609:a409054e1395
user:        Jim Blandy <[e-mail]>
date:        Wed Sep 15 13:43:55 2010 -0700
summary:     Bug 537873, Bug 514574: Have strict mode code report TypeErrors for assignments, deletions. r=brendan

Comment 3

[Boris Zbarsky [:bzbarsky]]

Probably from that ObjectOps::setProperty changeset.

Comment 4

[Jason Orendorff [:jorendorff]]

Shorter:

var a = Object.create(Array.prototype);
a.push(3);
assertEq(a.length, 1);

For some reason the bug only happens if the prototype is a sparse array. If it's dense, the behavior is correct.