Closed Bug 592296 Opened 14 years ago Closed 8 years ago

js_InitArrayClass should make Array.prototype a slow array _ab initio_

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: brendan, Unassigned)

Details

Andreas tried this and broke gmail for want of a length accessor, IIRC. It may have been more subtle than that. I'll try to find the bug.

/be
It was kinda subtle. The code only tolerates making dense arrays that then become slow. The slowification path makes the "length" property on slow arrays. If you allocate a slow array without going through that path, there is no resolve hook to make 'length'.
What's the advantage of doing this?
Its currently born as a dense array, only to be slowified during construction since it contains named properties.
Assignee: general → nobody
Slow arrays were removed in https://hg.mozilla.org/mozilla-central/rev/f4671ccc4502.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.