Bug 80467

Summary: Array.prototype functions should throw if delete fails
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fix
none
Fix (forgot a ChangeLog in last patch) oliver: review+

Description Gavin Barraclough 2012-03-06 18:12:39 PST 
All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw.  In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations in JSArray.cpp.  There are effectively three copies of each of the generic shift/unshift routines, one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift routines, for handling arrays with holes.  These three copies should be unified.
Comment 1 Gavin Barraclough 2012-03-06 18:16:16 PST 
Created attachment 130505 [details]
Fix
Comment 2 WebKit Review Bot 2012-03-06 18:18:32 PST 
Attachment 130505 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
LayoutTests/ChangeLog:1:  ChangeLog entry has no bug number  [changelog/bugnumber] [5]
Total errors found: 1 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 3 Gavin Barraclough 2012-03-06 18:24:17 PST 
Created attachment 130509 [details]
Fix (forgot a ChangeLog in last patch)
Comment 4 Gavin Barraclough 2012-03-06 23:49:13 PST 
Fixed in r110026