RESOLVED FIXED80467
Array.prototype functions should throw if delete fails
https://bugs.webkit.org/show_bug.cgi?id=80467
Summary Array.prototype functions should throw if delete fails
Gavin Barraclough
Reported 2012-03-06 18:12:39 PST
All calls to [[Delete]] from Array.prototype are specified to pass 'true' as the value of Throw. In the case of shift/unshift, these are also missing a throw from the 'put' in the implementations in JSArray.cpp. There are effectively three copies of each of the generic shift/unshift routines, one in splice, one in ArrayPrototype's shift/unshift methods, and one in JSArray's shift/unshift routines, for handling arrays with holes. These three copies should be unified.
Attachments
Fix (26.72 KB, patch)
2012-03-06 18:16 PST, Gavin Barraclough
no flags
Fix (forgot a ChangeLog in last patch) (26.83 KB, patch)
2012-03-06 18:24 PST, Gavin Barraclough
oliver: review+
Gavin Barraclough
Comment 1 2012-03-06 18:16:16 PST
WebKit Review Bot
Comment 2 2012-03-06 18:18:32 PST
Attachment 130505 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1 LayoutTests/ChangeLog:1: ChangeLog entry has no bug number [changelog/bugnumber] [5] Total errors found: 1 in 11 files If any of these errors are false positives, please file a bug against check-webkit-style.
Gavin Barraclough
Comment 3 2012-03-06 18:24:17 PST
Created attachment 130509 [details] Fix (forgot a ChangeLog in last patch)
Gavin Barraclough
Comment 4 2012-03-06 23:49:13 PST
Fixed in r110026
Note You need to log in before you can comment on or make changes to this bug.