From 58fd901fa9c83d1f0604fe2a5df3ea4a1d4f2818 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Sun, 11 Apr 2010 22:38:55 -0700
Subject: [PATCH] Bug 556165 - dead code in array_shift().  r=jwalden.

---
 js/src/jsarray.cpp | 61 ++++++++++++++++++++--------------------------
 1 file changed, 27 insertions(+), 34 deletions(-)

diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index 59e95568269..aab7f08f2e0 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2502,6 +2502,7 @@ array_shift(JSContext *cx, uintN argc, jsval *vp)
     obj = JS_THIS_OBJECT(cx, vp);
     if (!obj || !js_GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
+
     if (length == 0) {
         *vp = JSVAL_VOID;
     } else {
@@ -2509,42 +2510,34 @@ array_shift(JSContext *cx, uintN argc, jsval *vp)
 
         if (obj->isDenseArray() && !js_PrototypeHasIndexedProperties(cx, obj) &&
             length < js_DenseArrayCapacity(obj)) {
-            if (JS_LIKELY(obj->dslots != NULL)) {
-                *vp = obj->dslots[0];
-                if (*vp == JSVAL_HOLE)
-                    *vp = JSVAL_VOID;
-                else
-                    obj->decArrayCountBy(1);
-                memmove(obj->dslots, obj->dslots + 1, length * sizeof(jsval));
-                obj->dslots[length] = JSVAL_HOLE;
-            } else {
-                /*
-                 * We don't need to modify the indexed properties of an empty array
-                 * with an explicitly set non-zero length when shift() is called on
-                 * it, but note fallthrough to reduce the length by one.
-                 */
-                JS_ASSERT(obj->getArrayCount() == 0);
+            *vp = obj->dslots[0];
+            if (*vp == JSVAL_HOLE)
                 *vp = JSVAL_VOID;
-            }
-        } else {
-            /* Get the to-be-deleted property's value into vp ASAP. */
-            if (!GetArrayElement(cx, obj, 0, &hole, vp))
-                return JS_FALSE;
-
-            /* Slide down the array above the first element. */
-            AutoValueRooter tvr(cx);
-            for (i = 0; i != length; i++) {
-                if (!JS_CHECK_OPERATION_LIMIT(cx) ||
-                    !GetArrayElement(cx, obj, i + 1, &hole, tvr.addr()) ||
-                    !SetOrDeleteArrayElement(cx, obj, i, hole, tvr.value())) {
-                    return JS_FALSE;
-                }
-            }
-
-            /* Delete the only or last element when it exists. */
-            if (!hole && !DeleteArrayElement(cx, obj, length))
-                return JS_FALSE;
+            else
+                obj->decArrayCountBy(1);
+            memmove(obj->dslots, obj->dslots + 1, length * sizeof(jsval));
+            obj->dslots[length] = JSVAL_HOLE;
+            obj->setArrayLength(length);
+            return JS_TRUE;
         }
+
+        /* Get the to-be-deleted property's value into vp ASAP. */
+        if (!GetArrayElement(cx, obj, 0, &hole, vp))
+            return JS_FALSE;
+
+        /* Slide down the array above the first element. */
+        AutoValueRooter tvr(cx);
+        for (i = 0; i != length; i++) {
+            if (!JS_CHECK_OPERATION_LIMIT(cx) ||
+                !GetArrayElement(cx, obj, i + 1, &hole, tvr.addr()) ||
+                !SetOrDeleteArrayElement(cx, obj, i, hole, tvr.value())) {
+                return JS_FALSE;
+            }
+        }
+
+        /* Delete the only or last element when it exists. */
+        if (!hole && !DeleteArrayElement(cx, obj, length))
+            return JS_FALSE;
     }
     return js_SetLengthProperty(cx, obj, length);
 }