Closed Bug 583429 Opened 12 years ago Closed 12 years ago

TM: Array.prototype lost its length property

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: gal, Assigned: gal)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

I changed the code to directly construct a slow array, but that lost the length property, which is only created as a dense array is slowified. Insane.
Attached patch patchSplinter Review
Assignee: general → gal
Comment on attachment 461730 [details] [diff] [review]
patch

This patch removes a change I did before (make array.proto be constructed as slow arrays right away).
Attachment #461730 - Flags: review?(brendan)
Comment on attachment 461730 [details] [diff] [review]
patch

The js_InitClass reversion is good, hope we can avoid any special-casing there if we try again to have js_InitArrayClass init js_SlowArrayClass not js_ArrayClass.

/be
Attachment #461730 - Flags: review?(brendan) → review+
http://hg.mozilla.org/tracemonkey/rev/8853427f6b39
Whiteboard: fixed-in-tracemonkey
Test?
I don't think that does what you think it does: you really want

Object.getOwnPropertyNames(Array.prototype).indexOf("length") >= 0

Right?
Mhm. Right. That test is a little stupid. Want to fix it? On an iphone.
Thanks =)
This is what broke GMail in bug 582081.
Blocks: 582081
http://hg.mozilla.org/mozilla-central/rev/8853427f6b39
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.