590780 - Array.prototype.splice fails to delete tail elements when applied to non-array object.

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

js> var o={0:1, 1:2, 2:3, length:3};
js> Object.defineProperty(o, 0, {writable:false});
({1:2, 2:3, length:3, 0:1})
js> Array.prototype.splice.call(o,0,1)
[1]
js> o
({1:3, 2:3, length:2, 0:1})
js> 

This should have yielded:

{0:1, 1:3, length:2}

Comment 1

[Jim Blandy :jimb]

This isn't right. All Array.prototype members behave, in ES5, as if they were strict mode code: they pass 'true' for the 'Throw' parameters of [[Put]] and [[Delete]].

Comment 2

[Jim Blandy :jimb]

Here's the proper description of the bug:

js> var o={0:1, 1:2, 2:3, length:3};
js> Array.prototype.splice.call(o,0,1)
[1]
js> o
({0:2, 1:3, 2:3, length:2})
js> 

As before, o should be {0:1, 1:3, length:2}; o[2] should have been deleted.

Comment 3

[Paul Biggar]

(In reply to comment #2)
> As before, o should be {0:1, 1:3, length:2}; o[2] should have been deleted.

Surely we'd expect {0:2, 1:3, length:2}?

Comment 4

[Paul Biggar]

(In reply to comment #3)
> Surely we'd expect {0:2, 1:3, length:2}?

Or at least I hope so, since that's what my rewrite in bug 668024 gets.

Comment 5

[André Bargull [:anba]]

No longer reproducible - resolving as WFM.