Changeset 207344 in webkit

Timestamp:

Oct 14, 2016 9:23:42 AM (8 years ago)

Author:

Ryan Haddad

Message:

Unreviewed, rolling out r207322.

This change caused JSC test failures

Reverted changeset:

"Fix Array.prototype.splice ES6 compliance."
​https://bugs.webkit.org/show_bug.cgi?id=163372
​http://trac.webkit.org/changeset/207322

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/array-splice-on-frozen-object.js (deleted)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ArrayPrototype.cpp (modified) (3 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r207322.
+
+        This change caused JSC test failures
+
+        Reverted changeset:
+
+        "Fix Array.prototype.splice ES6 compliance."
+        https://bugs.webkit.org/show_bug.cgi?id=163372
+        http://trac.webkit.org/changeset/207322
+
 2016-10-14  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
+
+        Unreviewed, rolling out r207322.
+
+        This change caused JSC test failures
+
+        Reverted changeset:
+
+        "Fix Array.prototype.splice ES6 compliance."
+        https://bugs.webkit.org/show_bug.cgi?id=163372
+        http://trac.webkit.org/changeset/207322
+
 2016-10-14  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -923 +923 @@
 
     unsigned actualStart = argumentClampedIndexFromStartOrEnd(exec, 0, length);
-    RETURN_IF_EXCEPTION(scope, encodedJSValue());
 
     unsigned actualDeleteCount = length - actualStart;
-    unsigned insertCount = 0;
     if (exec->argumentCount() > 1) {
-        insertCount = exec->argumentCount() - 2;
         double deleteCount = exec->uncheckedArgument(1).toInteger(exec);
         if (deleteCount < 0)
@@ -938 +935 @@
     }
 
-    // FIXME: Need to implement step 8 of the spec https://tc39.github.io/ecma262/#sec-array.prototype.splice here.
-    // https://bugs.webkit.org/show_bug.cgi?id=163417
-
     std::pair<SpeciesConstructResult, JSObject*> speciesResult = speciesConstructArray(exec, thisObj, actualDeleteCount);
-    ASSERT(!scope.exception() || speciesResult.first == SpeciesConstructResult::Exception);
     if (speciesResult.first == SpeciesConstructResult::Exception)
-        return encodedJSValue();
+        return JSValue::encode(jsUndefined());
 
     JSObject* result = nullptr;
@@ -974 +967 @@
                 result->initializeIndex(vm, k, v);
             }
-            ASSERT(!scope.exception());
-        }
-        setLength(exec, vm, result, actualDeleteCount);
-        RETURN_IF_EXCEPTION(scope, encodedJSValue());
-    }
-
-    unsigned itemCount = insertCount;
-    ASSERT(itemCount == static_cast<unsigned>(std::max<int>(exec->argumentCount() - 2, 0)));
+        }
+    }
+
+    unsigned itemCount = std::max<int>(exec->argumentCount() - 2, 0);
     if (itemCount < actualDeleteCount) {
         shift<JSArray::ShiftCountForSplice>(exec, thisObj, actualStart, actualDeleteCount, itemCount, length);