Bug 570385: notify iterators of dense array property deletion in DeleteArrayElement, r=igor

2010-11-19 17:01:26 -08:00
parent 1e8a4119d4
commit 7201bfb96a
4 changed files with 30 additions and 1 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -500,7 +500,7 @@ DeleteArrayElement(JSContext *cx, JSObject *obj, jsdouble index, JSBool strict)
            jsuint idx = jsuint(index);
            if (idx < obj->getDenseArrayCapacity()) {
                obj->setDenseArrayElement(idx, MagicValue(JS_ARRAY_HOLE));
-                return JS_TRUE;
+                return js_SuppressDeletedIndexProperties(cx, obj, idx, idx+1);
            }
        }
        return JS_TRUE;