delete on an arguments[i] not working correctly

VERIFIED FIXED in 1.5R4

Status

Rhino
Core
VERIFIED FIXED
16 years ago
14 years ago

People

(Reporter: Phil Schwartau, Assigned: Norris Boyd)

Tracking

other
1.5R4
x86
Windows NT

Details

Attachments

(2 attachments)

(Reporter)

Description

16 years ago
Reported in the JS Engine newsgroup by ibukanov8@yahoo.com (Igor Bukanov):

"Given the following and my reading of Ecma-262

function test1(x) {
    x = 1;
    delete arguments[0];
    return x;
}

function test2(x) {
    x = 1;
    delete arguments[0];
    arguments[0] = -1;
    return x;
}


test1(0) and test2(0) should both return 1, since after |delete argument[0]|,
arguments[0] loses any connection with x, even if arguments[0] is recreated. 


From ECMA-262 Edition 3:


Section 10.1.8 Arguments Object

*  For each non-negative integer, arg, less than the value of the length
property, a property is created with name ToString(arg) and property
attributes { DontEnum }. The initial value of this property is the value 
of the corresponding actual parameter supplied by the caller. The first 
actual parameter value corresponds to arg = 0, the second to arg = 1, 
and so on. In the case when arg is less than the number of formal 
parameters for the Function object, this property shares its value with 
the corresponding property of the activation object. This means that 
changing this property changes the corresponding property of the 
activation object and vice versa.


Section 10.2.3 Function Code

*  Variable instantiation is performed using the activation object as 
the variable object and using property attributes { DontDelete }.


SpiderMonkey meets these expectations, but Rhino does not.
In Rhino, test1(0) returns |undefined|; test2(0) returns -1.


Note the testcase for bug 72884,

     mozilla/js/tests/ecma_3/Function/arguments-001.js

does not touch this area, so maybe it should be updated to
cover this issue as well -"



FOR REFERENCE:

bug 72884 (SpiderMonkey) "Arguments object has incorrect [[Prototype]] property"
bug 79568 (Rhino)        "delete on an arguments[i] not working correctly"
(Reporter)

Comment 1

16 years ago
Igor's test has been added to the JS testsuite:

          mozilla/js/tests/ecma_3/Function/regress-137181.js


Currently passing in SpiderMonkey, failing in Rhino:

FAILED!: Section 1 of test -
FAILED!: Expected value '1', Actual value 'undefined'

FAILED!: Section 2 of test -
FAILED!: Expected value '1', Actual value '-1'

Comment 2

16 years ago
Created attachment 79191 [details] [diff] [review]
Code fix: patch to omj/Arguments.java

The patch uses the special NOT_FOUND value to flag deleted indexes. It also
make sure that original array object passed to Function.call is not modified,
as all changes goes to cloned copy. It is not necessary for the fix, but it is
the only place in the current Rhino that can alter Object[] array passed to
Function.call and I think it is better to remove this exceptional case.

I will run the tests and if there are no objections will commit it in couple
days.

Comment 3

16 years ago
Created attachment 79192 [details] [diff] [review]
Fixing comments misspells in the previous patch version

Comment 4

16 years ago
I committed the fix so Rhino passes the additional tests.

Comment 5

15 years ago
As this is in Rhino CVS for a long time now, maybe it can be marked fixed/verified?
(Reporter)

Comment 6

15 years ago
Igor is correct - marking FIXED
Status: NEW → RESOLVED
Last Resolved: 15 years ago
Resolution: --- → FIXED
(Reporter)

Comment 7

15 years ago
Marking Verified Fixed.

Igor's testcase now passes in both the rhino and rhinoi shells -
Status: RESOLVED → VERIFIED

Comment 8

14 years ago
Targeting as resolved against 1.5R4
Target Milestone: --- → 1.5R4
You need to log in before you can comment on or make changes to this bug.