Closed Bug 742393 Opened 8 years ago Closed 8 years ago

JM+TI: Don't inline array.concat if Array.prototype has indexed properties

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla14

People

(Reporter: jandem, Assigned: jandem)

Details

Attachments

(1 file)

Noticed this while porting the array.concat fast path to Ion.

JM+TI fails the following testcase:
--
var global = 0;
Array.prototype.__defineGetter__("2", function() { return global++; });

function f() {
    var a = [];
    var b = [0, 1, , 3];
    for (var i=0; i<100; i++)
        var c = a.concat(b);
    assertEq(c[2], 99);
}
f();
--
test.js:9: Error: Assertion failed: got 41, expected 99

inlineNativeFunction should call ArrayPrototypeHasIndexedProperty like it does for array.push and array.pop
Attached patch PatchSplinter Review
Attachment #612211 - Flags: review?(bhackett1024)
Attachment #612211 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/5ddad6892466
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.