Bug 509047 - Defining a property that forces a dense array to become sparse shouldn't call a setter. r=brendan.
authorJason Orendorff <jorendorff@mozilla.com>
Fri, 07 Aug 2009 18:31:54 -0500
changeset 31474 d95798feba0495b272f5887189e22de70f74be94
parent 31473 a900ca6581b9b2841b8e45fc756aef82dd2dd971
child 31475 1cf3897d3691033028a00f83701007b648ee1781
push id8556
push userrsayre@mozilla.com
push dateThu, 13 Aug 2009 21:38:45 +0000
treeherdermozilla-central@9734564871cb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbrendan
bugs509047
milestone1.9.2a1pre
Bug 509047 - Defining a property that forces a dense array to become sparse shouldn't call a setter. r=brendan.
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -965,17 +965,17 @@ array_defineProperty(JSContext *cx, JSOb
 {
     uint32 i;
     JSBool isIndex;
 
     if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom))
         return JS_TRUE;
 
     isIndex = js_IdIsIndex(ID_TO_VALUE(id), &i);
-    if (!isIndex || attrs != JSPROP_ENUMERATE) {
+    if (!isIndex || attrs != JSPROP_ENUMERATE || !OBJ_IS_DENSE_ARRAY(cx, obj) || INDEX_TOO_SPARSE(obj, i)) {
         if (!ENSURE_SLOW_ARRAY(cx, obj))
             return JS_FALSE;
         return js_DefineProperty(cx, obj, id, value, getter, setter, attrs, propp);
     }
 
     return array_setProperty(cx, obj, id, &value);
 }