Closed Bug 583429 Opened 13 years ago Closed 13 years ago

TM: Array.prototype lost its length property

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: gal, Assigned: gal)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

patch
3.67 KB, patch
brendan
: review+
Details | Diff | Splinter Review 
I changed the code to directly construct a slow array, but that lost the length property, which is only created as a dense array is slowified. Insane.
Attached patch patch — — Splinter Review 
Assignee: general → gal

    
    

    
  
Comment on attachment 461730 [details] [diff] [review]
patch

This patch removes a change I did before (make array.proto be constructed as slow arrays right away).

        Attachment #461730 -
        Flags: review?(brendan)

    
    

    
  
Comment on attachment 461730 [details] [diff] [review]
patch

The js_InitClass reversion is good, hope we can avoid any special-casing there if we try again to have js_InitArrayClass init js_SlowArrayClass not js_ArrayClass.

/be

        Attachment #461730 -
        Flags: review?(brendan) → review+

    
    

    
  
http://hg.mozilla.org/tracemonkey/rev/8853427f6b39
Whiteboard: fixed-in-tracemonkey

    
    

    
  
Test?

    
    

    
  
I don't think that does what you think it does: you really want

Object.getOwnPropertyNames(Array.prototype).indexOf("length") >= 0

Right?

    
    

    
  
Mhm. Right. That test is a little stupid. Want to fix it? On an iphone.

    
    

    
  
Thanks =)

    
    

    
  
This is what broke GMail in bug 582081.
Blocks: 582081

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/8853427f6b39
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED

          You need to log in
          before you can comment on or make changes to this bug.