corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 610038 - apply should not ignore indexed properties on the prototype (r=waldo)

Browse Source
This commit is contained in:
Luke Wagner
2010-11-09 09:06:57 -08:00
parent 091f875cb2
commit 9abd7a88c3
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jsarray.cpp
View File

@@ -396,12 +396,15 @@ namespace js {
bool
GetElements(JSContext *cx, JSObject *aobj, jsuint length, Value *vp)
{
if (aobj->isDenseArray() && length <= aobj->getDenseArrayCapacity()) {
if (aobj->isDenseArray() && length <= aobj->getDenseArrayCapacity() &&
!js_PrototypeHasIndexedProperties(cx, aobj)) {
/* The prototype does not have indexed properties so hole = undefined */
Value *srcbeg = aobj->getDenseArrayElements();
Value *srcend = srcbeg + length;
for (Value *dst = vp, *src = srcbeg; src < srcend; ++dst, ++src)
*dst = src->isMagic(JS_ARRAY_HOLE) ? UndefinedValue() : *src;
} else if (aobj->isArguments() && !aobj->isArgsLengthOverridden()) {
} else if (aobj->isArguments() && !aobj->isArgsLengthOverridden() &&
!js_PrototypeHasIndexedProperties(cx, aobj)) {
/*
* Two cases, two loops: note how in the case of an active stack frame
* backing aobj, even though we copy from fp->argv, we still must check