Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-25 11:15:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1219363 - Fix sort of indexed properties to not include properties already in the Vector. r=jorendorff

Browse Source
This commit is contained in:
Jan de Mooij 2015-11-03 08:34:56 +01:00
parent 18d1d4fd3d
commit 636e8bffb2
2 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
js/src/jit-test/tests/basic/bug1219363.js Normal file
View File

@ -0,0 +1,9 @@
var x = [1, 2, , 4]
x[100000] = 1;
var y = Object.create(x);
y.a = 1;
y.b = 1;
var arr = [];
for (var z in y)
arr.push(z);
assertEq(arr.join(), "a,b,0,1,3,100000");

14
js/src/jsiter.cpp
View File

@ -181,6 +181,7 @@ EnumerateNativeProperties(JSContext* cx, HandleNativeObject pobj, unsigned flags
enumerateSymbols = true;
} else {
/* Collect any dense elements from this object. */
size_t firstElemIndex = props->length();
size_t initlen = pobj->getDenseInitializedLength();
const Value* vp = pobj->getDenseElements();
bool hasHoles = false;
@ -206,7 +207,10 @@ EnumerateNativeProperties(JSContext* cx, HandleNativeObject pobj, unsigned flags
// Collect any sparse elements from this object.
bool isIndexed = pobj->isIndexed();
if (isIndexed) {
size_t numElements = props->length();
// If the dense elements didn't have holes, we don't need to include
// them in the sort.
if (!hasHoles)
firstElemIndex = props->length();
for (Shape::Range<NoGC> r(pobj->lastProperty()); !r.empty(); r.popFront()) {
Shape& shape = r.front();
@ -218,12 +222,10 @@ EnumerateNativeProperties(JSContext* cx, HandleNativeObject pobj, unsigned flags
}
}
// If the dense elements didn't have holes, we don't need to include
// them in the sort.
size_t startIndex = hasHoles ? 0 : numElements;
MOZ_ASSERT(firstElemIndex <= props->length());
jsid* ids = props->begin() + startIndex;
size_t n = props->length() - startIndex;
jsid* ids = props->begin() + firstElemIndex;
size_t n = props->length() - firstElemIndex;
AutoIdVector tmp(cx);
if (!tmp.resize(n))