Bug 3881 – arguments object should share values with function parameters

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Geoffrey Garen]

Test failures caused:
        ecma_3/ExecutionContexts/10.1.3-1.js
        ecma_3/Function/arguments-001.js

Spec: ECMA 10.1.8

For each non-negative integer, arg, less than the value of the length property, a property is created 
with name ToString(arg) and property attributes { DontEnum }. The initial value of this property is the 
value of the corresponding actual parameter supplied by the caller. The first actual parameter value 
corresponds to arg = 0, the second to arg = 1, and so on. In the case when arg is less than the number 
of formal parameters for the Function object, this property shares its value with the corresponding 
property of the activation object. This means that changing this property changes the corresponding 
property of the activation object and vice versa.

[Geoffrey Garen]

Created attachment 2840 [details]
Patch w/updated test results

This patch includes the fix for 3878, since both patches modify the same code.
3878 is now obsolete.

[Maciej Stachowiak]

Let's go over this patch in person. It looks surprisingly complicated.

[Maciej Stachowiak]

Geoff and I discussed a possible simpler way to do this. review- for now

[Geoffrey Garen]

Created attachment 2913 [details]
Simpler patch

This patch uses a simpler class that hashes array indexes to their property
names in the activation object. createArgumentsObject() is still n-squared.
Once this patch checks in, I'll open a separate bug about that.

[Maciej Stachowiak]

Comment on attachment 2913 [details]
Simpler patch

This patch looks great. The behavior when deleting seemed odd to me at first
(it woudl unmap but not delete the underlying property) but seems to match
other browsers.

r=me

[Geoffrey Garen]

(In reply to comment #5)

FYI: Mozilla's take on the odd deleting behavior is at: https://bugzilla.mozilla.org/show_bug.cgi?
id=137181

[Geoffrey Garen]

Created attachment 2926 [details]
Simpler patch w/updated test results

Also edited a comment and removed 2 unused function declarations.

[Geoffrey Garen]

Created attachment 2928 [details]
infinite loop fix

Patch 2926 uses index instead of indexAsNumber, resulting in infinite
recursion.