• barraclough@apple.com's avatar
    Array.prototype functions should throw if delete fails · 1052f503
    barraclough@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=80467
    
    Reviewed by Oliver Hunt.
    
    Source/JavaScriptCore: 
    
    All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.
    In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations
    in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines,
    one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift
    routines, for handling arrays with holes. These three copies should be unified.
    
    * runtime/ArrayPrototype.cpp:
    (JSC::shift):
    (JSC::unshift):
        - Added - shared copies of the shift/unshift functionality.
    (JSC::arrayProtoFuncPop):
        - should throw if the delete fails.
    (JSC::arrayProtoFuncReverse):
        - should throw if the delete fails.
    (JSC::arrayProtoFuncShift):
    (JSC::arrayProtoFuncSplice):
    (JSC::arrayProtoFuncUnShift):
        - use shift/unshift.
    * runtime/JSArray.cpp:
    (JSC::JSArray::shiftCount):
    (JSC::JSArray::unshiftCount):
        - Don't try to handle arrays with holes; return a value indicating
          the generic routine should be used instead.
    * runtime/JSArray.h:
        - declaration for shiftCount/unshiftCount changed.
    * tests/mozilla/js1_6/Array/regress-304828.js:
        - this was asserting incorrect behaviour.
    
    LayoutTests: 
    
    * fast/js/mozilla/strict/15.4.4.12-expected.txt:
    * fast/js/mozilla/strict/15.4.4.13-expected.txt:
    * fast/js/mozilla/strict/15.4.4.6-expected.txt:
    * fast/js/mozilla/strict/15.4.4.8-expected.txt:
    * fast/js/mozilla/strict/15.4.4.9-expected.txt:
        - check in passing test results.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110026 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    1052f503
JSArray.cpp 73.1 KB