Bug 1014813 - Always set array length for JSOP_INITELEM_INC with hole. r=jandem
authorTooru Fujisawa <arai_a@mac.com>
Fri, 30 May 2014 20:27:45 +0900
changeset 206906 dae53a38052e91c0fc27c0a0c994acba96970b9f
parent 206905 2d06b7c9cc5bd0f1441598190e16d75e56043ebb
child 206907 fbda3cc3461a75b08351edb22e944fd3f08762c7
push id494
push userraliiev@mozilla.com
push dateMon, 25 Aug 2014 18:42:16 +0000
treeherdermozilla-release@a3cc3e46b571 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1014813
milestone32.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1014813 - Always set array length for JSOP_INITELEM_INC with hole. r=jandem
js/src/jit-test/tests/basic/spread-array.js
js/src/vm/Interpreter-inl.h
--- a/js/src/jit-test/tests/basic/spread-array.js
+++ b/js/src/jit-test/tests/basic/spread-array.js
@@ -6,16 +6,17 @@ assertEqArray([...[1, 2, 3]], [1, 2, 3])
 assertEqArray([1, ...[2, 3, 4], 5], [1, 2, 3, 4, 5]);
 assertEqArray([1, ...[], 2], [1, 2]);
 assertEqArray([1, ...[2, 3], 4, ...[5, 6]], [1, 2, 3, 4, 5, 6]);
 assertEqArray([1, ...[], 2], [1, 2]);
 assertEqArray([1,, ...[2]], [1,, 2]);
 assertEqArray([1,, ...[2],, 3,, 4,], [1,, 2,, 3,, 4,]);
 assertEqArray([...[1, 2, 3],,,,], [1, 2, 3,,,,]);
 assertEqArray([,,...[1, 2, 3],,,,], [,,1,2,3,,,,]);
+assertEqArray([...[1, 2, 3],,,,...[]], [1,2,3,,,,]);
 
 assertEqArray([...[undefined]], [undefined]);
 
 // other iterable objects
 assertEqArray([...new Int32Array([1, 2, 3])], [1, 2, 3]);
 assertEqArray([..."abc"], ["a", "b", "c"]);
 assertEqArray([...[1, 2, 3][std_iterator]()], [1, 2, 3]);
 assertEqArray([...Set([1, 2, 3])], [1, 2, 3]);
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -480,23 +480,26 @@ InitArrayElemOperation(JSContext *cx, js
     JS_ASSERT(op == JSOP_INITELEM_ARRAY || op == JSOP_INITELEM_INC);
 
     JS_ASSERT(obj->is<ArrayObject>());
 
     /*
      * If val is a hole, do not call JSObject::defineElement. In this case,
      * if the current op is the last element initialiser, set the array length
      * to one greater than id.
+     *
+     * If val is a hole and current op is JSOP_INITELEM_INC, always call
+     * SetLengthProperty even if it is not the last element initialiser,
+     * because it may be followed by JSOP_SPREAD, which will not set the array
+     * length if nothing is spreaded.
      */
     if (val.isMagic(JS_ELEMENTS_HOLE)) {
         JSOp next = JSOp(*GetNextPc(pc));
 
-        if ((op == JSOP_INITELEM_ARRAY && next == JSOP_ENDINIT) ||
-            (op == JSOP_INITELEM_INC && next == JSOP_POP))
-        {
+        if ((op == JSOP_INITELEM_ARRAY && next == JSOP_ENDINIT) || op == JSOP_INITELEM_INC) {
             if (!SetLengthProperty(cx, obj, index + 1))
                 return false;
         }
     } else {
         if (!JSObject::defineElement(cx, obj, index, val, nullptr, nullptr, JSPROP_ENUMERATE))
             return false;
     }