wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 830967 - Don't skip sparse elements in 'this' when optimizing Array.concat, r=billm.

Browse Source
This commit is contained in:
Brian Hackett 2013-01-15 15:03:44 -07:00
parent ba1f6b5a3b
commit d7567c2f79
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jit-test/tests/basic/bug830967.js Normal file
View File

@ -0,0 +1,4 @@
var x = Array.concat(Object.freeze([{}]));
assertEq(x.length, 1);
assertEq(0 in x, true);
assertEq(JSON.stringify(x[0]), "{}");

4
js/src/jsarray.cpp
View File

@ -2022,7 +2022,7 @@ js::array_concat(JSContext *cx, unsigned argc, Value *vp)
RootedObject nobj(cx);
uint32_t length;
if (aobj->isArray()) {
if (aobj->isArray() && !aobj->isIndexed()) {
length = aobj->getArrayLength();
uint32_t initlen = aobj->getDenseInitializedLength();
nobj = NewDenseCopiedArray(cx, initlen, aobj, 0);
@ -2602,6 +2602,8 @@ JSObject *
js::NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset,
RawObject proto /* = NULL */)
{
JS_ASSERT(!src->isIndexed());
JSObject* obj = NewArray<true>(cx, length, proto);
if (!obj)
return NULL;