Classes extending Array don't work

RESOLVED DUPLICATE of bug 599159

Status

()

--
major
RESOLVED DUPLICATE of bug 599159
8 years ago
8 years ago

People

(Reporter: t.brain, Assigned: bhackett)

Tracking

({regression})

unspecified
x86
Windows Vista
regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking2.0 betaN+)

Details

(Reporter)

Description

8 years ago
User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)
Build Identifier: 4.0b7

A subclass of Array stops reporting the right length when an additional method is added to its prototype.

This is a regression in 4.0b7, and is confirmed to work as expected in 4.0b6 and 3.5.

Reproducible: Always

Steps to Reproduce:
Use the following code:

  function MyArray() {}
  MyArray.prototype=new Array();
  MyArray.prototype.item=function (x) { return this[x]; }

  var arr=new MyArray();
  arr.push("foo");
  alert(arr.length);

Actual Results:  
Alerts 0 in 4.0b7, alerts 1 in 4.0b6 and 3.5.

Expected Results:  
Should alert 1.
(Reporter)

Comment 1

8 years ago
Sorry, I meant 3.6 in the original report. Confirmed to be working as expected in 3.6.12, 3.5.13, 3.0.19 and 2.0.0.20.
Due to skipped revisions, the first bad revision could be any of:
changeset:   53606:a55097cd48d8
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Use ObjectOps::setProperty for both fast and slow arrays. r=brendan

changeset:   53607:8f7761878ba5
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Tests for strict mode assignments to read-only properties, deletions of non-configurable properties. r=jorendorff

changeset:   53608:9cfceee11abd
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Delete unused property operation typedefs: JSDefinePropOp, JSPropertyIdOp. r=luke

changeset:   53609:a409054e1395
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:55 2010 -0700
summary:     Bug 537873, Bug 514574: Have strict mode code report TypeErrors for assignments, deletions. r=brendan
Probably from that ObjectOps::setProperty changeset.
Blocks: 537873, 514574
Status: UNCONFIRMED → NEW
blocking2.0: --- → ?
Ever confirmed: true
Keywords: regression

Updated

8 years ago
blocking2.0: ? → betaN+

Updated

8 years ago
No longer depends on: 614070
Shorter:

var a = Object.create(Array.prototype);
a.push(3);
assertEq(a.length, 1);

For some reason the bug only happens if the prototype is a sparse array. If it's dense, the behavior is correct.
Duplicate of this bug: 615506
(Assignee)

Updated

8 years ago
Assignee: general → bhackett1024
(Assignee)

Updated

8 years ago
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 599159

Updated

8 years ago
No longer blocks: 537873

Updated

8 years ago
Blocks: 537873
You need to log in before you can comment on or make changes to this bug.