-
barraclough@apple.com authored
https://bugs.webkit.org/show_bug.cgi?id=80467 Reviewed by Oliver Hunt. Source/JavaScriptCore: All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw. In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines, one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift routines, for handling arrays with holes. These three copies should be unified. * runtime/ArrayPrototype.cpp: (JSC::shift): (JSC::unshift): - Added - shared copies of the shift/unshift functionality. (JSC::arrayProtoFuncPop): - should throw if the delete fails. (JSC::arrayProtoFuncReverse): - should throw if the delete fails. (JSC::arrayProtoFuncShift): (JSC::arrayProtoFuncSplice): (JSC::arrayProtoFuncUnShift): - use shift/unshift. * runtime/JSArray.cpp: (JSC::JSArray::shiftCount): (JSC::JSArray::unshiftCount): - Don't try to handle arrays with holes; return a value indicating the generic routine should be used instead. * runtime/JSArray.h: - declaration for shiftCount/unshiftCount changed. * tests/mozilla/js1_6/Array/regress-304828.js: - this was asserting incorrect behaviour. LayoutTests: * fast/js/mozilla/strict/15.4.4.12-expected.txt: * fast/js/mozilla/strict/15.4.4.13-expected.txt: * fast/js/mozilla/strict/15.4.4.6-expected.txt: * fast/js/mozilla/strict/15.4.4.8-expected.txt: * fast/js/mozilla/strict/15.4.4.9-expected.txt: - check in passing test results. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110026 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1052f503