Ensure properties deleted by setting Array#length are suppressed in active for..in iteration

RESOLVED FIXED in Firefox 43

Status

()

Core
JavaScript Engine
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: till, Assigned: till)

Tracking

(Blocks: 1 bug)

unspecified
mozilla43
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox43 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

3 years ago
Found this while working on bug 890329: setting Array#length to a smaller value on a dense array while enumerating that array didn't properly suppress the deleted properties for the iteration. Other engines get this right, and we do, too, for all other things I could think of, but not this.

After discussions with Waldo, avoiding the fast-path in ArraySetLength seems to be the right solution.

This is required for a performant implementation of Array#splice, which I'll upload next.
(Assignee)

Comment 1

3 years ago
Created attachment 8646253 [details] [diff] [review]
Ensure properties deleted by setting Array#length are suppressed in active for..in iteration
Attachment #8646253 - Flags: review?(jdemooij)
Comment on attachment 8646253 [details] [diff] [review]
Ensure properties deleted by setting Array#length are suppressed in active for..in iteration

Review of attachment 8646253 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.
Attachment #8646253 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 4

3 years ago
url:        https://hg.mozilla.org/integration/mozilla-inbound/rev/5f225d39fb1f62745ed01f27996a3eaf2f964cf4
changeset:  5f225d39fb1f62745ed01f27996a3eaf2f964cf4
user:       Till Schneidereit <till@tillschneidereit.net>
date:       Tue Aug 11 11:27:03 2015 +0200
description:
Bug 1193212 - Ensure properties deleted by setting Array#length are suppressed in active for..in iteration. r=jandem
https://hg.mozilla.org/mozilla-central/rev/5f225d39fb1f
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox43: --- → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in before you can comment on or make changes to this bug.