JM+TI: Don't inline array.concat if Array.prototype has indexed properties

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

unspecified
mozilla14
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
Noticed this while porting the array.concat fast path to Ion.

JM+TI fails the following testcase:
--
var global = 0;
Array.prototype.__defineGetter__("2", function() { return global++; });

function f() {
    var a = [];
    var b = [0, 1, , 3];
    for (var i=0; i<100; i++)
        var c = a.concat(b);
    assertEq(c[2], 99);
}
f();
--
test.js:9: Error: Assertion failed: got 41, expected 99

inlineNativeFunction should call ArrayPrototypeHasIndexedProperty like it does for array.push and array.pop
(Assignee)

Comment 1

5 years ago
Created attachment 612211 [details] [diff] [review]
Patch
Attachment #612211 - Flags: review?(bhackett1024)
Attachment #612211 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ddad6892466
Target Milestone: --- → mozilla14
https://hg.mozilla.org/mozilla-central/rev/5ddad6892466
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.