• barraclough@apple.com's avatar
    Array.prototype functions should throw if delete fails · 1052f503
    barraclough@apple.com authored
    Reviewed by Oliver Hunt.
    All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.
    In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations
    in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines,
    one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift
    routines, for handling arrays with holes. These three copies should be unified.
    * runtime/ArrayPrototype.cpp:
        - Added - shared copies of the shift/unshift functionality.
        - should throw if the delete fails.
        - should throw if the delete fails.
        - use shift/unshift.
    * runtime/JSArray.cpp:
        - Don't try to handle arrays with holes; return a value indicating
          the generic routine should be used instead.
    * runtime/JSArray.h:
        - declaration for shiftCount/unshiftCount changed.
    * tests/mozilla/js1_6/Array/regress-304828.js:
        - this was asserting incorrect behaviour.
    * fast/js/mozilla/strict/
    * fast/js/mozilla/strict/
    * fast/js/mozilla/strict/
    * fast/js/mozilla/strict/
    * fast/js/mozilla/strict/
        - check in passing test results.
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110026 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSArray.cpp 73.1 KB