Suppress deleted properties during iteration (569735, r=brendan).

2010-06-03 21:41:01 -07:00
parent 5de2b7cc60
commit f45dc6f17f
9 changed files with 139 additions and 12 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -102,6 +102,7 @@
 #include "jsfun.h"
 #include "jsgc.h"
 #include "jsinterp.h"
+#include "jsiter.h"
 #include "jslock.h"
 #include "jsnum.h"
 #include "jsobj.h"
@@ -1051,6 +1052,9 @@ array_deleteProperty(JSContext *cx, JSObject *obj, jsval id, jsval *rval)
        obj->setDenseArrayElement(i, JSVAL_HOLE);
    }

+    if (!js_SuppressDeletedProperty(cx, obj, id))
+        return false;
+
    *rval = JSVAL_TRUE;
    return JS_TRUE;
 }