Last Comment Bug 675164 - Inherited splice doesn't call delete
: Inherited splice doesn't call delete
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 5 Branch
: x86 Linux
-- normal (vote)
: ---
Assigned To: Paul Biggar
: Jason Orendorff [:jorendorff]
Depends on: 668024
  Show dependency treegraph
Reported: 2011-07-29 02:07 PDT by Tomasz Kołodziejski [:tomasz]
Modified: 2011-10-18 09:09 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Tomasz Kołodziejski [:tomasz] 2011-07-29 02:07:57 PDT
User Agent: Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0
Build ID: 20110615151330

Steps to reproduce:


whilst creating a specific list for my purposes I encountered a problem. I stripped everything and my final reproduction code looks like:

function NPList(){
NPList.prototype = new Array;

list = new NPList();


list.splice(0, 1);

alert(list.length + ' ' + list[0]);

Which I believe should not happen.

Actual results:

0 'a'

Expected results:

0 undefined
Comment 1 User image Paul Biggar 2011-07-29 12:02:45 PDT
I'm rewriting the splice code in bug 668024, so I'll look at this one.
Comment 2 User image Paul Biggar 2011-07-29 14:10:42 PDT
This is a bug, expected results are exactly as Tomasz says. The good news is that that's the result my rewrite gives, so this will be fixed by bug 668024.

Thanks for the report and the minimized test case Tomasz!

Note You need to log in before you can comment on or make changes to this bug.