From be5cbeb9c40a4098b60c7f04306b24e956d40512 Mon Sep 17 00:00:00 2001
From: "nboyd%atg.com" <nboyd%atg.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sat, 24 Nov 2007 02:07:44 +0000
Subject: [PATCH] Fix problem reported on newsgroup by Christophe Grand:

  I noticed that the java array backing the "arguments" variable is reused
    in Array iterative methods. For example:

    var f = function() { return arguments };
    var a = [1, 2].map(f);
    a[0][0] === a[1][0]

  returns true. (Spidermonkey returns false.)

  There's an easy fix: in NativeArray.iterativeMethod move
  Object[] innerArgs = new Object[3];
  inside the for loop.

  (I ran into this issue while calling asynchronous functions e.g.
  msgs.forEach(process))... which ended processing n times the same data!)

Also made some minor changes as long as I was in the file.


git-svn-id: svn://10.0.0.236/trunk@239888 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../src/org/mozilla/javascript/NativeArray.java  | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/mozilla/js/rhino/src/org/mozilla/javascript/NativeArray.java b/mozilla/js/rhino/src/org/mozilla/javascript/NativeArray.java
index 2bc64df92b8..8d60332cf08 100644
--- a/mozilla/js/rhino/src/org/mozilla/javascript/NativeArray.java
+++ b/mozilla/js/rhino/src/org/mozilla/javascript/NativeArray.java
@@ -56,11 +56,6 @@ public class NativeArray extends IdScriptableObject
      * - Long vs. double schizophrenia.  I suspect it might be better
      * to use double throughout.
      *
-     * - Need to examine these methods to see if they'd benefit from an
-     * optimized code path using <code>dense</code>:
-     *      toStringHelper
-     *      iterativeMethod
-     *
      * - Functions that need a new Array call "new Array" in the
      * current scope rather than using a hardwired constructor;
      * "Array" could be redefined.  It turns out that js calls the
@@ -1426,17 +1421,10 @@ public class NativeArray extends IdScriptableObject
             thisArg = ScriptRuntime.toObject(cx, scope, args[1]);
         }
         long length = getLengthProperty(cx, thisObj);
-        Scriptable array = null;
-        if (id == Id_filter) {
-            array = ScriptRuntime.newObject(cx, scope, "Array", null);
-        } else if (id == Id_map) {
-            // allocate dense array for efficiency
-            Object[] ctorArgs = { new Long(length) };
-            array = ScriptRuntime.newObject(cx, scope, "Array", ctorArgs);
-        }
-        Object[] innerArgs = new Object[3];
+        Scriptable array = ScriptRuntime.newObject(cx, scope, "Array", null);
         long j=0;
         for (long i=0; i < length; i++) {
+            Object[] innerArgs = new Object[3];
             Object elem = (i > Integer.MAX_VALUE)
                 ? ScriptableObject.getProperty(thisObj, Long.toString(i))
                 : ScriptableObject.getProperty(thisObj, (int)i);