Closed
Bug 1193212
Opened 9 years ago
Closed 9 years ago
Ensure properties deleted by setting Array#length are suppressed in active for..in iteration
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla43
Tracking | Status | |
---|---|---|
firefox43 | --- | fixed |
People
(Reporter: till, Assigned: till)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
Found this while working on bug 890329: setting Array#length to a smaller value on a dense array while enumerating that array didn't properly suppress the deleted properties for the iteration. Other engines get this right, and we do, too, for all other things I could think of, but not this. After discussions with Waldo, avoiding the fast-path in ArraySetLength seems to be the right solution. This is required for a performant implementation of Array#splice, which I'll upload next.
Assignee | ||
Comment 1•9 years ago
|
||
Attachment #8646253 -
Flags: review?(jdemooij)
Assignee | ||
Comment 2•9 years ago
|
||
https://treeherder.mozilla.org/#/jobs?repo=try&revision=4eaac267a35f
Comment 3•9 years ago
|
||
Comment on attachment 8646253 [details] [diff] [review] Ensure properties deleted by setting Array#length are suppressed in active for..in iteration Review of attachment 8646253 [details] [diff] [review]: ----------------------------------------------------------------- Makes sense.
Attachment #8646253 -
Flags: review?(jdemooij) → review+
Assignee | ||
Comment 4•9 years ago
|
||
url: https://hg.mozilla.org/integration/mozilla-inbound/rev/5f225d39fb1f62745ed01f27996a3eaf2f964cf4 changeset: 5f225d39fb1f62745ed01f27996a3eaf2f964cf4 user: Till Schneidereit <till@tillschneidereit.net> date: Tue Aug 11 11:27:03 2015 +0200 description: Bug 1193212 - Ensure properties deleted by setting Array#length are suppressed in active for..in iteration. r=jandem
Comment 5•9 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/5f225d39fb1f
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
status-firefox43:
--- → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in
before you can comment on or make changes to this bug.
Description
•