Array.prototype.splice fails to delete tail elements when applied to non-array object.

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
RESOLVED WORKSFORME
8 years ago
2 years ago

People

(Reporter: jimb, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

8 years ago
js> var o={0:1, 1:2, 2:3, length:3};
js> Object.defineProperty(o, 0, {writable:false});
({1:2, 2:3, length:3, 0:1})
js> Array.prototype.splice.call(o,0,1)
[1]
js> o
({1:3, 2:3, length:2, 0:1})
js> 

This should have yielded:

{0:1, 1:3, length:2}
(Reporter)

Comment 1

8 years ago
This isn't right. All Array.prototype members behave, in ES5, as if they were strict mode code: they pass 'true' for the 'Throw' parameters of [[Put]] and [[Delete]].
(Reporter)

Comment 2

8 years ago
Here's the proper description of the bug:

js> var o={0:1, 1:2, 2:3, length:3};
js> Array.prototype.splice.call(o,0,1)
[1]
js> o
({0:2, 1:3, 2:3, length:2})
js> 

As before, o should be {0:1, 1:3, length:2}; o[2] should have been deleted.

Comment 3

7 years ago
(In reply to comment #2)
> As before, o should be {0:1, 1:3, length:2}; o[2] should have been deleted.

Surely we'd expect {0:2, 1:3, length:2}?

Comment 4

7 years ago
(In reply to comment #3)
> Surely we'd expect {0:2, 1:3, length:2}?

Or at least I hope so, since that's what my rewrite in bug 668024 gets.
(Assignee)

Updated

4 years ago
Assignee: general → nobody
No longer reproducible - resolving as WFM.
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.