+ ASSERT(index != 0xFFFFFFFF);
+
+ if (!inSparseMode()) {
+ // Fast case: we're putting a regular property to a regular array
+ // FIXME: this will pessimistically assume that if attributes are missing then they'll default to false
+ // – however if the property currently exists missing attributes will override from their current 'true'
+ // state (i.e. defineOwnProperty could be used to set a value without needing to entering 'SparseMode').
+ if (!descriptor.attributes()) {
+ ASSERT(!descriptor.isAccessorDescriptor());
+ return putDirectIndex(exec, index, descriptor.value(), throwException);
+ }
+
+ enterDictionaryMode(exec->globalData());
+ }
+
+ SparseArrayValueMap* map = m_sparseValueMap;
+ ASSERT(map);
+
+ // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
+ SparseArrayValueMap::AddResult result = map->add(this, index);
+ SparseArrayEntry* entryInMap = &result.iterator->second;
+
+ // 2. Let extensible be the value of the [[Extensible]] internal property of O.
+ // 3. If current is undefined and extensible is false, then Reject.
+ // 4. If current is undefined and extensible is true, then
+ if (result.isNewEntry) {
+ if (!isExtensible()) {
+ map->remove(result.iterator);
+ return reject(exec, throwException, "Attempting to define property on object that is not extensible.");
+ }
+
+ // 4.a. If IsGenericDescriptor(Desc) or IsDataDescriptor(Desc) is true, then create an own data property
+ // named P of object O whose [[Value]], [[Writable]], [[Enumerable]] and [[Configurable]] attribute values
+ // are described by Desc. If the value of an attribute field of Desc is absent, the attribute of the newly
+ // created property is set to its default value.
+ // 4.b. Else, Desc must be an accessor Property Descriptor so, create an own accessor property named P of
+ // object O whose [[Get]], [[Set]], [[Enumerable]] and [[Configurable]] attribute values are described by
+ // Desc. If the value of an attribute field of Desc is absent, the attribute of the newly created property
+ // is set to its default value.
+ // 4.c. Return true.
+
+ PropertyDescriptor defaults;
+ entryInMap->setWithoutWriteBarrier(jsUndefined());
+ entryInMap->attributes = DontDelete | DontEnum | ReadOnly;
+ entryInMap->get(defaults);
+
+ putDescriptor(exec, entryInMap, descriptor, defaults);
+ if (index >= m_storage->m_length)
+ m_storage->m_length = index + 1;
+ return true;
+ }
+
+ // 5. Return true, if every field in Desc is absent.
+ // 6. Return true, if every field in Desc also occurs in current and the value of every field in Desc is the same value as the corresponding field in current when compared using the SameValue algorithm (9.12).
+ PropertyDescriptor current;
+ entryInMap->get(current);
+ if (descriptor.isEmpty() || descriptor.equalTo(exec, current))
+ return true;
+
+ // 7. If the [[Configurable]] field of current is false then
+ if (!current.configurable()) {
+ // 7.a. Reject, if the [[Configurable]] field of Desc is true.
+ if (descriptor.configurablePresent() && descriptor.configurable())
+ return reject(exec, throwException, "Attempting to change configurable attribute of unconfigurable property.");
+ // 7.b. Reject, if the [[Enumerable]] field of Desc is present and the [[Enumerable]] fields of current and Desc are the Boolean negation of each other.
+ if (descriptor.enumerablePresent() && current.enumerable() != descriptor.enumerable())
+ return reject(exec, throwException, "Attempting to change enumerable attribute of unconfigurable property.");
+ }
+
+ // 8. If IsGenericDescriptor(Desc) is true, then no further validation is required.
+ if (!descriptor.isGenericDescriptor()) {
+ // 9. Else, if IsDataDescriptor(current) and IsDataDescriptor(Desc) have different results, then
+ if (current.isDataDescriptor() != descriptor.isDataDescriptor()) {
+ // 9.a. Reject, if the [[Configurable]] field of current is false.
+ if (!current.configurable())
+ return reject(exec, throwException, "Attempting to change access mechanism for an unconfigurable property.");
+ // 9.b. If IsDataDescriptor(current) is true, then convert the property named P of object O from a
+ // data property to an accessor property. Preserve the existing values of the converted property‘s
+ // [[Configurable]] and [[Enumerable]] attributes and set the rest of the property‘s attributes to
+ // their default values.
+ // 9.c. Else, convert the property named P of object O from an accessor property to a data property.
+ // Preserve the existing values of the converted property‘s [[Configurable]] and [[Enumerable]]
+ // attributes and set the rest of the property‘s attributes to their default values.
+ } else if (current.isDataDescriptor() && descriptor.isDataDescriptor()) {
+ // 10. Else, if IsDataDescriptor(current) and IsDataDescriptor(Desc) are both true, then
+ // 10.a. If the [[Configurable]] field of current is false, then
+ if (!current.configurable() && !current.writable()) {
+ // 10.a.i. Reject, if the [[Writable]] field of current is false and the [[Writable]] field of Desc is true.
+ if (descriptor.writable())
+ return reject(exec, throwException, "Attempting to change writable attribute of unconfigurable property.");
+ // 10.a.ii. If the [[Writable]] field of current is false, then
+ // 10.a.ii.1. Reject, if the [[Value]] field of Desc is present and SameValue(Desc.[[Value]], current.[[Value]]) is false.
+ if (descriptor.value() && !sameValue(exec, descriptor.value(), current.value()))
+ return reject(exec, throwException, "Attempting to change value of a readonly property.");
+ }
+ // 10.b. else, the [[Configurable]] field of current is true, so any change is acceptable.
+ } else {
+ ASSERT(current.isAccessorDescriptor() && current.getterPresent() && current.setterPresent());
+ // 11. Else, IsAccessorDescriptor(current) and IsAccessorDescriptor(Desc) are both true so, if the [[Configurable]] field of current is false, then
+ if (!current.configurable()) {
+ // 11.i. Reject, if the [[Set]] field of Desc is present and SameValue(Desc.[[Set]], current.[[Set]]) is false.
+ if (descriptor.setterPresent() && descriptor.setter() != current.setter())
+ return reject(exec, throwException, "Attempting to change the setter of an unconfigurable property.");
+ // 11.ii. Reject, if the [[Get]] field of Desc is present and SameValue(Desc.[[Get]], current.[[Get]]) is false.
+ if (descriptor.getterPresent() && descriptor.getter() != current.getter())
+ return reject(exec, throwException, "Attempting to change the getter of an unconfigurable property.");
+ }
+ }
+ }
+
+ // 12. For each attribute field of Desc that is present, set the correspondingly named attribute of the property named P of object O to the value of the field.
+ putDescriptor(exec, entryInMap, descriptor, current);
+ // 13. Return true.
+ return true;
+}
+
+void JSArray::setLengthWritable(ExecState* exec, bool writable)
+{
+ ASSERT(isLengthWritable() || !writable);
+ if (!isLengthWritable() || writable)
+ return;
+
+ enterDictionaryMode(exec->globalData());
+
+ SparseArrayValueMap* map = m_sparseValueMap;
+ ASSERT(map);
+ map->setLengthIsReadOnly();
+}
+
+// Defined in ES5.1 15.4.5.1
+bool JSArray::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
+{
+ JSArray* array = jsCast<JSArray*>(object);
+
+ // 3. If P is "length", then
+ if (propertyName == exec->propertyNames().length) {
+ // All paths through length definition call the default [[DefineOwnProperty]], hence:
+ // from ES5.1 8.12.9 7.a.
+ if (descriptor.configurablePresent() && descriptor.configurable())
+ return reject(exec, throwException, "Attempting to change configurable attribute of unconfigurable property.");
+ // from ES5.1 8.12.9 7.b.
+ if (descriptor.enumerablePresent() && descriptor.enumerable())
+ return reject(exec, throwException, "Attempting to change enumerable attribute of unconfigurable property.");
+
+ // a. If the [[Value]] field of Desc is absent, then
+ // a.i. Return the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", Desc, and Throw as arguments.
+ if (descriptor.isAccessorDescriptor())
+ return reject(exec, throwException, "Attempting to change access mechanism for an unconfigurable property.");
+ // from ES5.1 8.12.9 10.a.
+ if (!array->isLengthWritable() && descriptor.writablePresent() && descriptor.writable())
+ return reject(exec, throwException, "Attempting to change writable attribute of unconfigurable property.");
+ // This descriptor is either just making length read-only, or changing nothing!
+ if (!descriptor.value()) {
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
+ return true;
+ }
+
+ // b. Let newLenDesc be a copy of Desc.
+ // c. Let newLen be ToUint32(Desc.[[Value]]).
+ unsigned newLen = descriptor.value().toUInt32(exec);
+ // d. If newLen is not equal to ToNumber( Desc.[[Value]]), throw a RangeError exception.
+ if (newLen != descriptor.value().toNumber(exec)) {
+ throwError(exec, createRangeError(exec, "Invalid array length"));
+ return false;
+ }
+
+ // Based on SameValue check in 8.12.9, this is always okay.
+ if (newLen == array->length()) {
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
+ return true;
+ }
+
+ // e. Set newLenDesc.[[Value] to newLen.
+ // f. If newLen >= oldLen, then
+ // f.i. Return the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and Throw as arguments.
+ // g. Reject if oldLenDesc.[[Writable]] is false.
+ if (!array->isLengthWritable())
+ return reject(exec, throwException, "Attempting to change value of a readonly property.");
+
+ // h. If newLenDesc.[[Writable]] is absent or has the value true, let newWritable be true.
+ // i. Else,
+ // i.i. Need to defer setting the [[Writable]] attribute to false in case any elements cannot be deleted.
+ // i.ii. Let newWritable be false.
+ // i.iii. Set newLenDesc.[[Writable] to true.
+ // j. Let succeeded be the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and Throw as arguments.
+ // k. If succeeded is false, return false.
+ // l. While newLen < oldLen repeat,
+ // l.i. Set oldLen to oldLen – 1.
+ // l.ii. Let deleteSucceeded be the result of calling the [[Delete]] internal method of A passing ToString(oldLen) and false as arguments.
+ // l.iii. If deleteSucceeded is false, then
+ if (!array->setLength(exec, newLen, throwException)) {
+ // 1. Set newLenDesc.[[Value] to oldLen+1.
+ // 2. If newWritable is false, set newLenDesc.[[Writable] to false.
+ // 3. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", newLenDesc, and false as arguments.
+ // 4. Reject.
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
+ return false;
+ }
+
+ // m. If newWritable is false, then
+ // i. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length",
+ // Property Descriptor{[[Writable]]: false}, and false as arguments. This call will always
+ // return true.
+ if (descriptor.writablePresent())
+ array->setLengthWritable(exec, descriptor.writable());
+ // n. Return true.
+ return true;
+ }
+
+ // 4. Else if P is an array index (15.4), then
+ bool isArrayIndex;
+ // a. Let index be ToUint32(P).
+ unsigned index = propertyName.toArrayIndex(isArrayIndex);
+ if (isArrayIndex) {
+ // b. Reject if index >= oldLen and oldLenDesc.[[Writable]] is false.
+ if (index >= array->length() && !array->isLengthWritable())
+ return reject(exec, throwException, "Attempting to define numeric property on array with non-writable length property.");
+ // c. Let succeeded be the result of calling the default [[DefineOwnProperty]] internal method (8.12.9) on A passing P, Desc, and false as arguments.
+ // d. Reject if succeeded is false.
+ // e. If index >= oldLen
+ // e.i. Set oldLenDesc.[[Value]] to index + 1.
+ // e.ii. Call the default [[DefineOwnProperty]] internal method (8.12.9) on A passing "length", oldLenDesc, and false as arguments. This call will always return true.
+ // f. Return true.
+ return array->defineOwnNumericProperty(exec, index, descriptor, throwException);
+ }
+
+ return JSObject::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
+}
+
+bool JSArray::getOwnPropertySlotByIndex(JSCell* cell, ExecState* exec, unsigned i, PropertySlot& slot)
+{
+ JSArray* thisObject = jsCast<JSArray*>(cell);
+ ArrayStorage* storage = thisObject->m_storage;