Last Comment Bug 742393 - JM+TI: Don't inline array.concat if Array.prototype has indexed properties
: JM+TI: Don't inline array.concat if Array.prototype has indexed properties
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla14
Assigned To: Jan de Mooij [:jandem]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-04 08:43 PDT by Jan de Mooij [:jandem]
Modified: 2012-04-12 10:19 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch (1.84 KB, patch)
2012-04-04 08:56 PDT, Jan de Mooij [:jandem]
bhackett1024: review+
Details | Diff | Review

Description Jan de Mooij [:jandem] 2012-04-04 08:43:38 PDT
Noticed this while porting the array.concat fast path to Ion.

JM+TI fails the following testcase:
--
var global = 0;
Array.prototype.__defineGetter__("2", function() { return global++; });

function f() {
    var a = [];
    var b = [0, 1, , 3];
    for (var i=0; i<100; i++)
        var c = a.concat(b);
    assertEq(c[2], 99);
}
f();
--
test.js:9: Error: Assertion failed: got 41, expected 99

inlineNativeFunction should call ArrayPrototypeHasIndexedProperty like it does for array.push and array.pop
Comment 1 Jan de Mooij [:jandem] 2012-04-04 08:56:18 PDT
Created attachment 612211 [details] [diff] [review]
Patch
Comment 3 :Ehsan Akhgari (busy, don't ask for review please) 2012-04-12 10:19:44 PDT
https://hg.mozilla.org/mozilla-central/rev/5ddad6892466

Note You need to log in before you can comment on or make changes to this bug.