Bug 18402 – REGRESSION: visited element handling is incorrect in nested join/toString calls

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Alexey Proskuryakov]

Array implementation used to have a single static HashSet for toString(), toLocalizedString() and join(). Now that these methods have been moved to separate functions, the HashSets are separate, too, which can be detected from JavaScript.

AFAIK, ECMA-262 doesn't define error handling in this case, but I think that we'd like to maintain Firefox compatibility.

[Alexey Proskuryakov]

Created attachment 20450 [details]
test case

[Alexey Proskuryakov]

Created attachment 20453 [details]
proposed fix

[Alexey Proskuryakov]

Created attachment 20454 [details]
proposed fix

Forgot to save ChangeLog before making the patch.

[Alexey Proskuryakov]

Created attachment 20455 [details]
proposed fix

Third time's the charm?

[Geoffrey Garen]

+            OwnPtr<HashSet<JSObject*> > visitedElements;

Since this variable is now visible outside of the array implementation file, I think it needs a more specific name. How about "arrayVisitedElements"? Maybe also add a comment that says "Global data shared by array prototype functions".

Please land this patch with your testcase.

r=me

[Mark Rowe (bdash)]

Comment on attachment 20455 [details]
proposed fix

Setting r+ based on Geoff's r=me.

[Alexey Proskuryakov]

Committed revision 31807.