Commit 30ddfb17 authored by barraclough@apple.com's avatar barraclough@apple.com

pop of array hole should get from the prototype chain

https://bugs.webkit.org/show_bug.cgi?id=79338

Reviewed by Sam Weinig.

Source/JavaScriptCore: 

* runtime/JSArray.cpp:
(JSC::JSArray::pop):
    - If the fast fast vector case fails, more closely follow the spec.

LayoutTests: 

* sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.6_Array_prototype_pop/S15.4.4.6_A4_T1-expected.txt:
    - Checking passing test result.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@108650 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 7914d5af
2012-02-23 Gavin Barraclough <barraclough@apple.com>
pop of array hole should get from the prototype chain
https://bugs.webkit.org/show_bug.cgi?id=79338
Reviewed by Sam Weinig.
* sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.6_Array_prototype_pop/S15.4.4.6_A4_T1-expected.txt:
- Checking passing test result.
2012-02-23 Csaba Osztrogonác <ossy@webkit.org>
[Qt] Unreviewed gardening.
S15.4.4.6_A4_T1
FAIL SputnikError: #1: Array.prototype[1] = 1; x = [0]; x.length = 2; x.pop() === 1. Actual: undefined
PASS
TEST COMPLETE
2012-02-23 Gavin Barraclough <barraclough@apple.com>
pop of array hole should get from the prototype chain
https://bugs.webkit.org/show_bug.cgi?id=79338
Reviewed by Sam Weinig.
* runtime/JSArray.cpp:
(JSC::JSArray::pop):
- If the fast fast vector case fails, more closely follow the spec.
2012-02-23 Yong Li <yoli@rim.com>
JSString::outOfMemory() should ASSERT(isRope()) rather than !isRope()
......@@ -1184,7 +1184,6 @@ bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException
JSValue JSArray::pop(ExecState* exec)
{
checkConsistency();
ArrayStorage* storage = m_storage;
unsigned length = storage->m_length;
......@@ -1194,47 +1193,32 @@ JSValue JSArray::pop(ExecState* exec)
return jsUndefined();
}
--length;
JSValue result;
if (length < m_vectorLength) {
WriteBarrier<Unknown>& valueSlot = storage->m_vector[length];
unsigned index = length - 1;
if (index < m_vectorLength) {
WriteBarrier<Unknown>& valueSlot = storage->m_vector[index];
if (valueSlot) {
--storage->m_numValuesInVector;
result = valueSlot.get();
JSValue element = valueSlot.get();
valueSlot.clear();
} else
result = jsUndefined();
} else {
result = jsUndefined();
if (SparseArrayValueMap* map = m_sparseValueMap) {
SparseArrayValueMap::iterator it = map->find(length);
if (it != map->notFound()) {
unsigned attributes = it->second.attributes;
result = it->second.get(exec, this);
if (exec->hadException())
return jsUndefined();
if (attributes & DontDelete) {
throwError(exec, createTypeError(exec, "Unable to delete property."));
checkConsistency();
return result;
}
map->remove(it);
if (map->isEmpty() && !map->sparseMode())
deallocateSparseMap();
}
ASSERT(isLengthWritable());
storage->m_length = index;
checkConsistency();
return element;
}
}
storage->m_length = length;
// Let element be the result of calling the [[Get]] internal method of O with argument indx.
JSValue element = get(exec, index);
if (exec->hadException())
return jsUndefined();
// Call the [[Delete]] internal method of O with arguments indx and true.
deletePropertyByIndex(this, exec, index);
// Call the [[Put]] internal method of O with arguments "length", indx, and true.
setLength(exec, index, true);
// Return element.
checkConsistency();
return result;
return element;
}
// Push & putIndex are almost identical, with two small differences.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment