Array implementation used to have a single static HashSet for toString(), toLocalizedString() and join(). Now that these methods have been moved to separate functions, the HashSets are separate, too, which can be detected from JavaScript. AFAIK, ECMA-262 doesn't define error handling in this case, but I think that we'd like to maintain Firefox compatibility.
Created attachment 20450 [details] test case
Created attachment 20453 [details] proposed fix
Created attachment 20454 [details] proposed fix Forgot to save ChangeLog before making the patch.
Created attachment 20455 [details] proposed fix Third time's the charm?
+ OwnPtr<HashSet<JSObject*> > visitedElements; Since this variable is now visible outside of the array implementation file, I think it needs a more specific name. How about "arrayVisitedElements"? Maybe also add a comment that says "Global data shared by array prototype functions". Please land this patch with your testcase. r=me
Comment on attachment 20455 [details] proposed fix Setting r+ based on Geoff's r=me.
Committed revision 31807.