1767541 - Array includes breaks on sparse arrays created with the Array constructor

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[ljharb]

Steps to reproduce:

[,].includes() correctly returns true, because a sparse array of length 1 does include "undefined".

Array(1).includes() incorrectly returns false, because a sparse array of length 1 is supposed to include "undefined".

Additionally, [,] and Array(1) should never have differing behavior, since they're identical operations in the spec. Note this happens in both 99 and 100.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1767541 - Part 1: Correctly handle trailing holes in Array.prototype.includes. r=jandem!

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1767541 - Part 2: Remove unreachable code in SearchElementDense generic path. r=jandem!

We don't have to call StrictlyEqual for holes in the SearchKind::Includes
code path, because holes are treated as "undefined" and "undefined" values are
already handled in the CanUseBitwiseCompareForStrictlyEqual path.

Depends on D145407

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1755489

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/11f5801a2506
Part 1: Correctly handle trailing holes in Array.prototype.includes. r=jandem
https://hg.mozilla.org/integration/autoland/rev/96e265267978
Part 2: Remove unreachable code in SearchElementDense generic path. r=jandem

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/11f5801a2506
https://hg.mozilla.org/mozilla-central/rev/96e265267978

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:anba, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 7

[André Bargull [:anba]]

I don't think we need to uplift these patches, because comment #0 doesn't indicate there's any website which is currently broken due to this bug.

Comment 8

[ljharb]

I'm sorry I missed this 2 months ago; this is forcing a workaround in some very large npm packages which have many tens of millions of weekly downloads.

It's violating the spec; this should be fixed ASAP.

Comment 9

[André Bargull [:anba]]

It's fixed in the current (version 102) release.

Comment 10

[ljharb]

Awesome, thank you! I missed that.