Test failures caused: ecma_3/ExecutionContexts/10.1.3-1.js ecma_3/Function/arguments-001.js Spec: ECMA 10.1.8 For each non-negative integer, arg, less than the value of the length property, a property is created with name ToString(arg) and property attributes { DontEnum }. The initial value of this property is the value of the corresponding actual parameter supplied by the caller. The first actual parameter value corresponds to arg = 0, the second to arg = 1, and so on. In the case when arg is less than the number of formal parameters for the Function object, this property shares its value with the corresponding property of the activation object. This means that changing this property changes the corresponding property of the activation object and vice versa.
Created attachment 2840 [details] Patch w/updated test results This patch includes the fix for 3878, since both patches modify the same code. 3878 is now obsolete.
Let's go over this patch in person. It looks surprisingly complicated.
Geoff and I discussed a possible simpler way to do this. review- for now
Created attachment 2913 [details] Simpler patch This patch uses a simpler class that hashes array indexes to their property names in the activation object. createArgumentsObject() is still n-squared. Once this patch checks in, I'll open a separate bug about that.
Comment on attachment 2913 [details] Simpler patch This patch looks great. The behavior when deleting seemed odd to me at first (it woudl unmap but not delete the underlying property) but seems to match other browsers. r=me
(In reply to comment #5) FYI: Mozilla's take on the odd deleting behavior is at: https://bugzilla.mozilla.org/show_bug.cgi? id=137181
Created attachment 2926 [details] Simpler patch w/updated test results Also edited a comment and removed 2 unused function declarations.
Created attachment 2928 [details] infinite loop fix Patch 2926 uses index instead of indexAsNumber, resulting in infinite recursion.