Some Array methods don't consider array holes and length

[Yusuke Suzuki]

Hello,

In some Array methods such as 'slice', 'splice', they don't [[Put]]
'length' value.
And they check [[HasProperty]] before [[DefineOwnProperty]]. As the result,
they waste empty trailing elements, but it is not compatible behavior to
ES3.

For example,

    [0,,,,].slice(0)

In ES3, this result is [0,,,,] and length is 4.
But, in ES5.1 algorithm step 10-k, kPresent is true when only the first
case comes, so result A is [0] and length is 1.

All the modern engines behave like ES3, so I think this is issue of ES5.1,
is it right?

The issue of the same kind was found before in Array.prototype.concat, and
I reported it.
https://mail.mozilla.org/pipermail/es5-discuss/2010-December/003851.html

And A of Array.prototype.splice has the same problem.
In section 15.4.4.12 step 9-c, we check fromPresent and
[[DefineOwnProperty]] to A, but we don't perform [[Put]] length operation
to A.

For example,

    [0,,,,].splice(0, 4)

In ES3, this result is [0,,,] and length is 4.
But, in ES5.1 algorithm step 9-c, fromPresent is true when only the first
case comes, so result A is [0] and length is 1.

So I suggest updating spec template that returns Array.

P.S.
Sorry for duplicate mails, they're reflected lately, so I thought they are
filtered.

Regards,
Yusuke Suzuki
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20120625/59af2af8/attachment-0001.html>