+ ASSERT(count > 0);
+
+ ArrayStorage* storage = m_storage;
+
+ unsigned oldLength = storage->m_length;
+
+ if (!oldLength)
+ return;
+
+ if (oldLength != storage->m_numValuesInVector) {
+ // If m_length and m_numValuesInVector aren't the same, we have a sparse vector
+ // which means we need to go through each entry looking for the the "empty"
+ // slots and then fill them with possible properties. See ECMA spec.
+ // 15.4.4.9 steps 11 through 13.
+ for (unsigned i = count; i < oldLength; ++i) {
+ if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
+ PropertySlot slot(this);
+ JSValue p = prototype();
+ if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
+ put(exec, i, slot.getValue(exec, i));
+ }
+ }
+
+ storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
+
+ // Need to decrement numValuesInvector based on number of real entries
+ for (unsigned i = 0; i < (unsigned)count; ++i)
+ if ((i < m_vectorLength) && (storage->m_vector[i]))
+ --storage->m_numValuesInVector;
+ } else
+ storage->m_numValuesInVector -= count;
+
+ storage->m_length -= count;
+
+ if (m_vectorLength) {
+ count = min(m_vectorLength, (unsigned)count);
+
+ m_vectorLength -= count;
+
+ if (m_vectorLength) {
+ char* newBaseStorage = reinterpret_cast<char*>(storage) + count * sizeof(JSValue);
+ memmove(newBaseStorage, storage, storageSize(0));
+ m_storage = reinterpret_cast_ptr<ArrayStorage*>(newBaseStorage);
+
+ m_indexBias += count;
+ }
+ }
+}
+
+void JSArray::unshiftCount(ExecState* exec, int count)
+{
+ ArrayStorage* storage = m_storage;
+
+ ASSERT(m_indexBias >= 0);
+ ASSERT(count >= 0);
+
+ unsigned length = storage->m_length;
+
+ if (length != storage->m_numValuesInVector) {
+ // If m_length and m_numValuesInVector aren't the same, we have a sparse vector
+ // which means we need to go through each entry looking for the the "empty"
+ // slots and then fill them with possible properties. See ECMA spec.
+ // 15.4.4.13 steps 8 through 10.
+ for (unsigned i = 0; i < length; ++i) {
+ if ((i >= m_vectorLength) || (!m_storage->m_vector[i])) {
+ PropertySlot slot(this);
+ JSValue p = prototype();
+ if ((!p.isNull()) && (asObject(p)->getPropertySlot(exec, i, slot)))
+ put(exec, i, slot.getValue(exec, i));
+ }
+ }
+ }
+
+ storage = m_storage; // The put() above could have grown the vector and realloc'ed storage.
+
+ if (m_indexBias >= count) {
+ m_indexBias -= count;
+ char* newBaseStorage = reinterpret_cast<char*>(storage) - count * sizeof(JSValue);
+ memmove(newBaseStorage, storage, storageSize(0));
+ m_storage = reinterpret_cast_ptr<ArrayStorage*>(newBaseStorage);
+ m_vectorLength += count;
+ } else if ((unsigned)count > (MAX_STORAGE_VECTOR_LENGTH - m_vectorLength)
+ || !increaseVectorPrefixLength(m_vectorLength + count)) {
+ throwOutOfMemoryError(exec);
+ return;
+ }
+
+ WriteBarrier<Unknown>* vector = m_storage->m_vector;
+ for (int i = 0; i < count; i++)
+ vector[i].clear();
+}
+
+void JSArray::visitChildren(SlotVisitor& visitor)
+{
+ ASSERT_GC_OBJECT_INHERITS(this, &s_info);
+ COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+ ASSERT(structure()->typeInfo().overridesVisitChildren());
+ visitChildrenDirect(visitor);