Split JSArray's [[Put]] & [[DefineOwnProperty]] traps.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Gavin Barraclough]

putByIndex() provides similar behavior to put(), but for indexed property names.  Many places in ArrayPrototype call putByIndex() where they really mean to call [[DefineOwnProperty]].  This is only okay due to a bug – putByIndex should be calling numeric accessors (& respecting numeric read only properties) on the prototype chain, but isn't.  Add a new putDirectIndex (matching JSObject's putDirect* methods), to correctly provide a fast [[DefineOwnProperty]] interface.

[Gavin Barraclough]

Created attachment 130012 [details]
Fix

No new tests – this does not yet change behavior (errors were not reachable, since ArrayPrototype is always creating new properties).

[WebKit Review Bot]

Attachment 130012 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1
Source/JavaScriptCore/runtime/JSArray.h:168:  Place brace on its own line for function definitions.  [whitespace/braces] [4]
Source/JavaScriptCore/runtime/JSArray.h:298:  The parameter name "exec" adds no information, so it should be removed.  [readability/parameter_name] [5]
Source/JavaScriptCore/runtime/JSArray.h:298:  The parameter name "value" adds no information, so it should be removed.  [readability/parameter_name] [5]
Total errors found: 3 in 4 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Gavin Barraclough]

Fixed in r109673