From 1eb8993931af941f33cc032d82e68fe8658c19ee Mon Sep 17 00:00:00 2001 From: "mrbkap%gmail.com" Date: Tue, 5 Jul 2005 21:25:12 +0000 Subject: [PATCH] bug 299644: Array.prototype.concat() plugs holes in the existing array. r+a=brendan git-svn-id: svn://10.0.0.236/trunk@175642 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsarray.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/mozilla/js/src/jsarray.c b/mozilla/js/src/jsarray.c index 38a002a720d..27d87bf074c 100644 --- a/mozilla/js/src/jsarray.c +++ b/mozilla/js/src/jsarray.c @@ -1274,10 +1274,23 @@ array_concat(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval) if (!ValueIsLength(cx, v, &alength)) return JS_FALSE; for (slot = 0; slot < alength; slot++) { + JSProperty *prop; + JSObject *obj2; + if (!IndexToId(cx, slot, &id)) return JS_FALSE; if (!IndexToId(cx, length + slot, &id2)) return JS_FALSE; + if (!OBJ_LOOKUP_PROPERTY(cx, aobj, id, &obj2, &prop)) + return JS_FALSE; + if (!prop) { + /* + * Per ECMA 262, 15.4.4.4, step 9, ignore non-existent + * properties. + */ + continue; + } + OBJ_DROP_PROPERTY(cx, obj2, prop); if (!OBJ_GET_PROPERTY(cx, aobj, id, &v)) return JS_FALSE; if (!OBJ_SET_PROPERTY(cx, nobj, id2, &v)) @@ -1295,7 +1308,7 @@ array_concat(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval) length++; } - return JS_TRUE; + return js_SetLengthProperty(cx, nobj, length); } static JSBool