investigate hole-correctness in array optimizations

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
P2
normal
RESOLVED WORKSFORME
10 years ago
5 years ago

People

(Reporter: shaver, Unassigned)

Tracking

Trunk
x86
All
Points:
---
Bug Flags:
wanted1.9.1 ?
blocking1.9 -
wanted1.9.0.x -

Firefox Tracking Flags

(Not tracked)

Details

In a couple of places (array_slice, and possible elsewhere) we mass copy the jsval vector to a new array, but if there are holes in the existing array segment then we can have some problems:

1) we need to ensure that COUNT is maintained correctly in the new array
2) if we have holes, we need to sample through to the prototype for values

If we maintain COUNT correctly, then the holes test is either COUNT == LENGTH - 1 or COUNT == DENSE_LENGTH - 1, depending on whether we care about trailing holes or not.

Need to audit those cases, and especially write tests.  Could have web-compat issues.
Flags: blocking1.9?

Comment 1

10 years ago
--> Shaver then.
Assignee: general → shaver
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2

Comment 2

10 years ago
Shaver says this doesn't need to block - moving to .next..
Flags: wanted1.9.0.x?
Flags: blocking1.9-
Flags: blocking1.9+

Updated

10 years ago
Flags: wanted1.9.1?
Don't think we'll want this on 1.9.0.x if it could cause web-compat issues, but feel free to renominate.
Flags: wanted1.9.0.x? → wanted1.9.0.x-

Updated

9 years ago
OS: Mac OS X → All
Assignee: shaver → general

Comment 4

5 years ago
A lot has changed, resolving WFM assuming there are no specific known issues.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.