742393 - JM+TI: Don't inline array.concat if Array.prototype has indexed properties

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Noticed this while porting the array.concat fast path to Ion.

JM+TI fails the following testcase:
--
var global = 0;
Array.prototype.__defineGetter__("2", function() { return global++; });

function f() {
    var a = [];
    var b = [0, 1, , 3];
    for (var i=0; i<100; i++)
        var c = a.concat(b);
    assertEq(c[2], 99);
}
f();
--
test.js:9: Error: Assertion failed: got 41, expected 99

inlineNativeFunction should call ArrayPrototypeHasIndexedProperty like it does for array.push and array.pop

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5ddad6892466

Comment 3

[(no longer active)]

https://hg.mozilla.org/mozilla-central/rev/5ddad6892466