corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 624041: skip elements deleted via shift or reverse in iteration, r=igor

Browse Source
This commit is contained in:
David Mandelin
2011-01-10 18:39:46 -08:00
parent a1254854de
commit 80184a0810
3 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
js/src/jsarray.cpp
View File

@@ -1483,9 +1483,18 @@ array_reverse(JSContext *cx, uintN argc, Value *vp)
uint32 lo = 0, hi = len - 1;
for (; lo < hi; lo++, hi--) {
Value tmp = obj->getDenseArrayElement(lo);
obj->setDenseArrayElement(lo, obj->getDenseArrayElement(hi));
obj->setDenseArrayElement(hi, tmp);
Value origlo = obj->getDenseArrayElement(lo);
Value orighi = obj->getDenseArrayElement(hi);
obj->setDenseArrayElement(lo, orighi);
if (orighi.isMagic(JS_ARRAY_HOLE) &&
!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(lo))) {
return false;
}
obj->setDenseArrayElement(hi, origlo);
if (origlo.isMagic(JS_ARRAY_HOLE) &&
!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(hi))) {
return false;
}
}
/*
@@ -1493,7 +1502,7 @@ array_reverse(JSContext *cx, uintN argc, Value *vp)
* array has trailing holes (and thus the original array began with
* holes).
*/
return JS_TRUE;
return true;
} while (false);
AutoValueRooter tvr(cx);
@@ -2155,6 +2164,8 @@ array_shift(JSContext *cx, uintN argc, Value *vp)
memmove(elems, elems + 1, length * sizeof(jsval));
obj->setDenseArrayElement(length, MagicValue(JS_ARRAY_HOLE));
obj->setArrayLength(length);
if (!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(length)))
return JS_FALSE;
return JS_TRUE;
}