Bug 3881 - arguments object should share values with function parameters
Summary: arguments object should share values with function parameters
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 412
Hardware: Mac OS X 10.4
: P2 Normal
Assignee: Maciej Stachowiak
URL:
Keywords:
Depends on:
Blocks: 3878
  Show dependency treegraph
 
Reported: 2005-07-06 17:20 PDT by Geoffrey Garen
Modified: 2005-07-12 11:32 PDT (History)
0 users

See Also:


Attachments
Patch w/updated test results (99.08 KB, patch)
2005-07-06 17:38 PDT, Geoffrey Garen
mjs: review-
Details | Formatted Diff | Diff
Simpler patch (8.21 KB, patch)
2005-07-11 18:51 PDT, Geoffrey Garen
mjs: review+
Details | Formatted Diff | Diff
Simpler patch w/updated test results (98.77 KB, patch)
2005-07-12 10:02 PDT, Geoffrey Garen
no flags Details | Formatted Diff | Diff
infinite loop fix (568 bytes, patch)
2005-07-12 11:32 PDT, Geoffrey Garen
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Geoffrey Garen 2005-07-06 17:20:27 PDT
Test failures caused:
        ecma_3/ExecutionContexts/10.1.3-1.js
        ecma_3/Function/arguments-001.js

Spec: ECMA 10.1.8

For each non-negative integer, arg, less than the value of the length property, a property is created 
with name ToString(arg) and property attributes { DontEnum }. The initial value of this property is the 
value of the corresponding actual parameter supplied by the caller. The first actual parameter value 
corresponds to arg = 0, the second to arg = 1, and so on. In the case when arg is less than the number 
of formal parameters for the Function object, this property shares its value with the corresponding 
property of the activation object. This means that changing this property changes the corresponding 
property of the activation object and vice versa.
Comment 1 Geoffrey Garen 2005-07-06 17:38:03 PDT
Created attachment 2840 [details]
Patch w/updated test results

This patch includes the fix for 3878, since both patches modify the same code.
3878 is now obsolete.
Comment 2 Maciej Stachowiak 2005-07-07 00:22:44 PDT
Let's go over this patch in person. It looks surprisingly complicated.
Comment 3 Maciej Stachowiak 2005-07-07 21:10:05 PDT
Geoff and I discussed a possible simpler way to do this. review- for now

Comment 4 Geoffrey Garen 2005-07-11 18:51:56 PDT
Created attachment 2913 [details]
Simpler patch

This patch uses a simpler class that hashes array indexes to their property
names in the activation object. createArgumentsObject() is still n-squared.
Once this patch checks in, I'll open a separate bug about that.
Comment 5 Maciej Stachowiak 2005-07-11 20:42:55 PDT
Comment on attachment 2913 [details]
Simpler patch

This patch looks great. The behavior when deleting seemed odd to me at first
(it woudl unmap but not delete the underlying property) but seems to match
other browsers.

r=me
Comment 6 Geoffrey Garen 2005-07-12 09:57:07 PDT
(In reply to comment #5)

FYI: Mozilla's take on the odd deleting behavior is at: https://bugzilla.mozilla.org/show_bug.cgi?
id=137181
Comment 7 Geoffrey Garen 2005-07-12 10:02:57 PDT
Created attachment 2926 [details]
Simpler patch w/updated test results

Also edited a comment and removed 2 unused function declarations.
Comment 8 Geoffrey Garen 2005-07-12 11:32:15 PDT
Created attachment 2928 [details]
infinite loop fix

Patch 2926 uses index instead of indexAsNumber, resulting in infinite
recursion.