Bug 435226 - dense arrays yield bogus __count__ values, r=shaver
authorbcrowder@mozilla.com
Mon, 09 Jun 2008 15:25:33 -0700
changeset 15531 1bbd2daaabb6c0204d2db369aaf87f2e77201583
parent 15530 4aeb5932fc5ac4deab932926fb50fa22f58681f3
child 15532 f171c57e016ecaa2e2d6b14f1a645c44cf4e6898
push id290
push userbcrowder@mozilla.com
push dateWed, 25 Jun 2008 20:55:16 +0000
treeherdermozilla-central@1bbd2daaabb6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshaver
bugs435226
milestone1.9.1a1pre
Bug 435226 - dense arrays yield bogus __count__ values, r=shaver
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -907,18 +907,18 @@ array_enumerate(JSContext *cx, JSObject 
 {
     uint32 length, i;
     JSIndexIterState *ii;
 
     switch (enum_op) {
       case JSENUMERATE_INIT:
         JS_ASSERT(OBJ_IS_DENSE_ARRAY(cx, obj));
         length = ARRAY_DENSE_LENGTH(obj);
-        if (idp && !IndexToId(cx, length, idp))
-            return JS_FALSE;
+        if (idp)
+            *idp = INT_TO_JSVAL(obj->fslots[JSSLOT_ARRAY_COUNT]);
         ii = NULL;
         for (i = 0; i != length; ++i) {
             if (obj->dslots[i] == JSVAL_HOLE) {
                 if (!ii) {
                     ii = (JSIndexIterState *)
                          JS_malloc(cx, offsetof(JSIndexIterState, holes) +
                                    JS_BITMAP_SIZE(length));
                     if (!ii)