bug 299644: Array.prototype.concat() plugs holes in the existing array.
r+a=brendan git-svn-id: svn://10.0.0.236/trunk@175642 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
parent
5c307ee46d
commit
1eb8993931
@ -1274,10 +1274,23 @@ array_concat(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
|
||||
if (!ValueIsLength(cx, v, &alength))
|
||||
return JS_FALSE;
|
||||
for (slot = 0; slot < alength; slot++) {
|
||||
JSProperty *prop;
|
||||
JSObject *obj2;
|
||||
|
||||
if (!IndexToId(cx, slot, &id))
|
||||
return JS_FALSE;
|
||||
if (!IndexToId(cx, length + slot, &id2))
|
||||
return JS_FALSE;
|
||||
if (!OBJ_LOOKUP_PROPERTY(cx, aobj, id, &obj2, &prop))
|
||||
return JS_FALSE;
|
||||
if (!prop) {
|
||||
/*
|
||||
* Per ECMA 262, 15.4.4.4, step 9, ignore non-existent
|
||||
* properties.
|
||||
*/
|
||||
continue;
|
||||
}
|
||||
OBJ_DROP_PROPERTY(cx, obj2, prop);
|
||||
if (!OBJ_GET_PROPERTY(cx, aobj, id, &v))
|
||||
return JS_FALSE;
|
||||
if (!OBJ_SET_PROPERTY(cx, nobj, id2, &v))
|
||||
@ -1295,7 +1308,7 @@ array_concat(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
|
||||
length++;
|
||||
}
|
||||
|
||||
return JS_TRUE;
|
||||
return js_SetLengthProperty(cx, nobj, length);
|
||||
}
|
||||
|
||||
static JSBool
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user