1193212 - Ensure properties deleted by setting Array#length are suppressed in active for..in iteration

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Till Schneidereit [:till]]

Found this while working on bug 890329: setting Array#length to a smaller value on a dense array while enumerating that array didn't properly suppress the deleted properties for the iteration. Other engines get this right, and we do, too, for all other things I could think of, but not this.

After discussions with Waldo, avoiding the fast-path in ArraySetLength seems to be the right solution.

This is required for a performant implementation of Array#splice, which I'll upload next.

Comment 1

[Till Schneidereit [:till]]

Attachment: Ensure properties deleted by setting Array#length are suppressed in active for..in iteration

Comment 2

[Till Schneidereit [:till]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4eaac267a35f

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8646253 [details] [diff] [review]
Ensure properties deleted by setting Array#length are suppressed in active for..in iteration

Review of attachment 8646253 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.

Comment 4

[Till Schneidereit [:till]]

url:        https://hg.mozilla.org/integration/mozilla-inbound/rev/5f225d39fb1f62745ed01f27996a3eaf2f964cf4
changeset:  5f225d39fb1f62745ed01f27996a3eaf2f964cf4
user:       Till Schneidereit <[e-mail]>
date:       Tue Aug 11 11:27:03 2015 +0200
description:
Bug 1193212 - Ensure properties deleted by setting Array#length are suppressed in active for..in iteration. r=jandem

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5f225d39fb1f