Closed Bug 612260 Opened 12 years ago Closed 12 years ago

Classes extending Array don't work

Categories

(Core :: JavaScript Engine, defect)

x86
Windows Vista
defect
Not set
major

Tracking

()

RESOLVED DUPLICATE of bug 599159
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: t.brain, Assigned: bhackett1024)

References

Details

(Keywords: regression)

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET4.0C)
Build Identifier: 4.0b7

A subclass of Array stops reporting the right length when an additional method is added to its prototype.

This is a regression in 4.0b7, and is confirmed to work as expected in 4.0b6 and 3.5.

Reproducible: Always

Steps to Reproduce:
Use the following code:

  function MyArray() {}
  MyArray.prototype=new Array();
  MyArray.prototype.item=function (x) { return this[x]; }

  var arr=new MyArray();
  arr.push("foo");
  alert(arr.length);

Actual Results:  
Alerts 0 in 4.0b7, alerts 1 in 4.0b6 and 3.5.

Expected Results:  
Should alert 1.
Sorry, I meant 3.6 in the original report. Confirmed to be working as expected in 3.6.12, 3.5.13, 3.0.19 and 2.0.0.20.
Due to skipped revisions, the first bad revision could be any of:
changeset:   53606:a55097cd48d8
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Use ObjectOps::setProperty for both fast and slow arrays. r=brendan

changeset:   53607:8f7761878ba5
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Tests for strict mode assignments to read-only properties, deletions of non-configurable properties. r=jorendorff

changeset:   53608:9cfceee11abd
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:54 2010 -0700
summary:     Bug 537873, Bug 514574: Delete unused property operation typedefs: JSDefinePropOp, JSPropertyIdOp. r=luke

changeset:   53609:a409054e1395
user:        Jim Blandy <jimb@mozilla.org>
date:        Wed Sep 15 13:43:55 2010 -0700
summary:     Bug 537873, Bug 514574: Have strict mode code report TypeErrors for assignments, deletions. r=brendan
Probably from that ObjectOps::setProperty changeset.
Blocks: 537873, 514574
Status: UNCONFIRMED → NEW
blocking2.0: --- → ?
Ever confirmed: true
Keywords: regression
Depends on: 614070
blocking2.0: ? → betaN+
No longer depends on: 614070
Shorter:

var a = Object.create(Array.prototype);
a.push(3);
assertEq(a.length, 1);

For some reason the bug only happens if the prototype is a sparse array. If it's dense, the behavior is correct.
Duplicate of this bug: 615506
Assignee: general → bhackett1024
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 599159
No longer blocks: 537873
Blocks: 537873
You need to log in before you can comment on or make changes to this bug.