Bug 537873, Bug 514574: Use ObjectOps::setProperty for both fast and slow arrays. r=brendan

js/src/jsarray.cpp

@@ -628,6 +628,13 @@ array_length_setter(JSContext *cx, JSObject *obj, jsid id, Value *vp)
     jsuint newlen, oldlen, gap, index;
     Value junk;
 
+    /* Check for a sealed object first. */
+    if (obj->sealed()) {
+        return js_ReportValueErrorFlags(cx, JSREPORT_ERROR, JSMSG_READ_ONLY,
+                                        JSDVG_IGNORE_STACK, IdToValue(id), NULL,
+                                        NULL, NULL);
+    }
+
     if (!obj->isArray()) {
         jsid lengthId = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
 
@@ -846,6 +853,17 @@ array_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
     return JS_TRUE;
 }
 
+static JSBool
+slowarray_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
+{
+    JS_ASSERT(obj->isSlowArray());
+
+    if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom))
+        return array_length_setter(cx, obj, id, vp, strict);
+
+    return js_SetProperty(cx, obj, id, vp, strict);
+}
+
 JSBool
 js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
 {
@@ -1022,7 +1040,34 @@ Class js_SlowArrayClass = {
     PropertyStub,   /* setProperty */
     EnumerateStub,
     ResolveStub,
-    js_TryValueOf
+    js_TryValueOf,
+    NULL,           /* finalize    */
+    NULL,           /* reserved0   */
+    NULL,           /* checkAccess */
+    NULL,           /* call        */
+    NULL,           /* construct   */
+    NULL,           /* xdrObject   */
+    NULL,           /* hasInstance */
+    NULL,           /* mark        */
+    JS_NULL_CLASS_EXT,
+    {
+        NULL,       /* lookupProperty   */
+        NULL,       /* defineProperty   */
+        NULL,       /* getProperty      */
+        /*
+         * For assignments to 'length', we need to know the setter's strictness. A property's
+         * setter isn't passed that, but the ObjectOps member is, so use that.
+         */
+        slowarray_setProperty,
+        NULL,       /* getAttributes    */
+        NULL,       /* setAttributes    */
+        NULL,       /* deleteProperty   */
+        NULL,       /* enumerate        */
+        NULL,       /* typeOf           */
+        NULL,       /* trace            */
+        NULL,       /* thisObject       */
+        NULL,       /* clear            */
+    }
 };
 
 /*
@@ -1062,7 +1107,7 @@ JSObject::makeDenseArraySlow(JSContext *cx)
 
     /* Begin with the length property to share more of the property tree. */
     if (!addProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom),
-                     array_length_getter, array_length_setter,
+                     array_length_getter, NULL,
                      JSSLOT_ARRAY_LENGTH, JSPROP_PERMANENT | JSPROP_SHARED, 0, 0)) {
         setMap(oldMap);
         return false;