bug 315509: array_unshift doesn't deal with holes in the array correctly. Patch from moz_bug_r_a4@yahoo.com. r=mrbkap

This commit is contained in:
mrbkap%gmail.com 2005-11-08 20:58:28 +00:00
parent d946f2be32
commit e5b2badc4d

View File

@ -1114,14 +1114,14 @@ array_unshift(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
while (last--) {
if (!IndexToExistingId(cx, obj, last, &id))
return JS_FALSE;
if (!IndexToId(cx, last + argc, &id2))
return JS_FALSE;
if (id == JSID_HOLE) {
OBJ_DELETE_PROPERTY(cx, obj, id2, &junk);
continue;
}
if (!OBJ_GET_PROPERTY(cx, obj, id, vp))
return JS_FALSE;
if (!IndexToId(cx, last + argc, &id2))
return JS_FALSE;
if (!OBJ_SET_PROPERTY(cx, obj, id2, vp))
return JS_FALSE;
}