corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 624041: skip elements deleted via shift or reverse in iteration, r=igor

Browse Source
This commit is contained in:
David Mandelin
2011-01-10 18:39:46 -08:00
parent 7bfb0d3e63
commit e8dc8e3a14
3 changed files with 30 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
js/src/jsarray.cpp
View File

@@ -1484,10 +1484,15 @@ array_reverse(JSContext *cx, uintN argc, Value *vp)
uint32 lo = 0, hi = len - 1;
for (; lo < hi; lo++, hi--) {
Value tmp = obj->getDenseArrayElement(lo);
obj->setDenseArrayElement(lo, obj->getDenseArrayElement(hi));
obj->setDenseArrayElement(hi, tmp);
}
Value origlo = obj->getDenseArrayElement(lo);
Value orighi = obj->getDenseArrayElement(hi);
obj->setDenseArrayElement(lo, orighi);
if (orighi.isMagic(JS_ARRAY_HOLE))
js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(lo));
obj->setDenseArrayElement(hi, origlo);
if (origlo.isMagic(JS_ARRAY_HOLE))
js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(hi));
}
/*
* Per ECMA-262, don't update the length of the array, even if the new
@@ -2156,6 +2161,8 @@ array_shift(JSContext *cx, uintN argc, Value *vp)
memmove(elems, elems + 1, length * sizeof(jsval));
obj->setDenseArrayElement(length, MagicValue(JS_ARRAY_HOLE));
obj->setArrayLength(length);
if (!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(length)));
return JS_FALSE;
return JS_TRUE;
}