1// Copyright 2010 the V8 project authors. All rights reserved.
2// Redistribution and use in source and binary forms, with or without
3// modification, are permitted provided that the following conditions are
4// met:
5//
6//     * Redistributions of source code must retain the above copyright
7//       notice, this list of conditions and the following disclaimer.
8//     * Redistributions in binary form must reproduce the above
9//       copyright notice, this list of conditions and the following
10//       disclaimer in the documentation and/or other materials provided
11//       with the distribution.
12//     * Neither the name of Google Inc. nor the names of its
13//       contributors may be used to endorse or promote products derived
14//       from this software without specific prior written permission.
15//
16// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
19// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
20// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
21// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
22// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
26// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27
28// Check that splicing array of holes keeps it as array of holes
29(function() {
30  for (var i = 0; i < 7; i++) {
31    var array = new Array(10);
32    var spliced = array.splice(1, 1, 'one', 'two');
33    assertEquals(1, spliced.length);
34    assertFalse(0 in spliced, "0 in spliced");
35
36    assertEquals(11, array.length);
37    assertFalse(0 in array, "0 in array");
38    assertTrue(1 in array);
39    assertTrue(2 in array);
40    assertFalse(3 in array, "3 in array");
41  }
42})();
43
44
45// Check various variants of empty array's splicing.
46(function() {
47  for (var i = 0; i < 7; i++) {
48    assertEquals([], [].splice(0, 0));
49    assertEquals([], [].splice(1, 0));
50    assertEquals([], [].splice(0, 1));
51    assertEquals([], [].splice(-1, 0));
52  }
53})();
54
55
56// Check that even if result array is empty, receiver gets sliced.
57(function() {
58  for (var i = 0; i < 7; i++) {
59    var a = [1, 2, 3];
60    assertEquals([], a.splice(1, 0, 'a', 'b', 'c'));
61    assertEquals([1, 'a', 'b', 'c', 2, 3], a);
62  }
63})();
64
65
66// Check various forms of arguments omission.
67(function() {
68  var array;
69  for (var i = 0; i < 7; i++) {
70    array = [1, 2, 3]
71    assertEquals([], array.splice());
72    assertEquals([1, 2, 3], array);
73
74    // SpiderMonkey, TraceMonkey and JSC treat the case where no delete count is
75    // given differently from when an undefined delete count is given.
76    // This does not follow ECMA-262, but we do the same for
77    // compatibility.
78    array = [1, 2, 3]
79    assertEquals([1, 2, 3], array.splice(0));
80    assertEquals([], array);
81
82    array = [1, 2, 3]
83    assertEquals([1, 2, 3], array.splice(undefined));
84    assertEquals([], array);
85
86    array = [1, 2, 3]
87    assertEquals([1, 2, 3], array.splice("foobar"));
88    assertEquals([], array);
89
90    array = [1, 2, 3]
91    assertEquals([], array.splice(undefined, undefined));
92    assertEquals([1, 2, 3], array);
93
94    array = [1, 2, 3]
95    assertEquals([], array.splice("foobar", undefined));
96    assertEquals([1, 2, 3], array);
97
98    array = [1, 2, 3]
99    assertEquals([], array.splice(undefined, "foobar"));
100    assertEquals([1, 2, 3], array);
101
102    array = [1, 2, 3]
103    assertEquals([], array.splice("foobar", "foobar"));
104    assertEquals([1, 2, 3], array);
105  }
106})();
107
108
109// Check variants of negatives and positive indices.
110(function() {
111  var array, spliced;
112  for (var i = 0; i < 7; i++) {
113    array = [1, 2, 3, 4, 5, 6, 7];
114    spliced = array.splice(-100);
115    assertEquals([], array);
116    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
117
118    array = [1, 2, 3, 4, 5, 6, 7];
119    spliced = array.splice(-1e100);
120    assertEquals([], array);
121    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
122
123    array = [1, 2, 3, 4, 5, 6, 7];
124    spliced = array.splice(-3);
125    assertEquals([1, 2, 3, 4], array);
126    assertEquals([5, 6, 7], spliced);
127
128    array = [1, 2, 3, 4, 5, 6, 7];
129    spliced = array.splice(-3.999999);
130    assertEquals([1, 2, 3, 4], array);
131    assertEquals([5, 6, 7], spliced);
132
133    array = [1, 2, 3, 4, 5, 6, 7];
134    spliced = array.splice(-3.000001);
135    assertEquals([1, 2, 3, 4], array);
136    assertEquals([5, 6, 7], spliced);
137
138    array = [1, 2, 3, 4, 5, 6, 7];
139    spliced = array.splice(4);
140    assertEquals([1, 2, 3, 4], array);
141    assertEquals([5, 6, 7], spliced);
142
143    array = [1, 2, 3, 4, 5, 6, 7];
144    spliced = array.splice(4.999999);
145    assertEquals([1, 2, 3, 4], array);
146    assertEquals([5, 6, 7], spliced);
147
148    array = [1, 2, 3, 4, 5, 6, 7];
149    spliced = array.splice(4.000001);
150    assertEquals([1, 2, 3, 4], array);
151    assertEquals([5, 6, 7], spliced);
152
153    array = [1, 2, 3, 4, 5, 6, 7];
154    spliced = array.splice(6);
155    assertEquals([1, 2, 3, 4, 5, 6], array);
156    assertEquals([7], spliced);
157
158    array = [1, 2, 3, 4, 5, 6, 7];
159    spliced = array.splice(7);
160    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
161    assertEquals([], spliced);
162
163    array = [1, 2, 3, 4, 5, 6, 7];
164    spliced = array.splice(8);
165    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
166    assertEquals([], spliced);
167
168    array = [1, 2, 3, 4, 5, 6, 7];
169    spliced = array.splice(100);
170    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
171    assertEquals([], spliced);
172
173    array = [1, 2, 3, 4, 5, 6, 7];
174    spliced = array.splice(1e100);
175    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
176    assertEquals([], spliced);
177
178    array = [1, 2, 3, 4, 5, 6, 7];
179    spliced = array.splice(0, -100);
180    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
181    assertEquals([], spliced);
182
183    array = [1, 2, 3, 4, 5, 6, 7];
184    spliced = array.splice(0, -1e100);
185    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
186    assertEquals([], spliced);
187
188    array = [1, 2, 3, 4, 5, 6, 7];
189    spliced = array.splice(0, -3);
190    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
191    assertEquals([], spliced);
192
193    array = [1, 2, 3, 4, 5, 6, 7];
194    spliced = array.splice(0, -3.999999);
195    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
196    assertEquals([], spliced);
197
198    array = [1, 2, 3, 4, 5, 6, 7];
199    spliced = array.splice(0, -3.000001);
200    assertEquals([1, 2, 3, 4, 5, 6, 7], array);
201    assertEquals([], spliced);
202
203    array = [1, 2, 3, 4, 5, 6, 7];
204    spliced = array.splice(0, 4);
205    assertEquals([5, 6, 7], array);
206    assertEquals([1, 2, 3, 4], spliced);
207
208    array = [1, 2, 3, 4, 5, 6, 7];
209    spliced = array.splice(0, 4.999999);
210    assertEquals([5, 6, 7], array);
211    assertEquals([1, 2, 3, 4], spliced);
212
213    array = [1, 2, 3, 4, 5, 6, 7];
214    spliced = array.splice(0, 4.000001);
215    assertEquals([5, 6, 7], array);
216    assertEquals([1, 2, 3, 4], spliced);
217
218    array = [1, 2, 3, 4, 5, 6, 7];
219    spliced = array.splice(0, 6);
220    assertEquals([7], array);
221    assertEquals([1, 2, 3, 4, 5, 6], spliced);
222
223    array = [1, 2, 3, 4, 5, 6, 7];
224    spliced = array.splice(0, 7);
225    assertEquals([], array);
226    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
227
228    array = [1, 2, 3, 4, 5, 6, 7];
229    spliced = array.splice(0, 8);
230    assertEquals([], array);
231    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
232
233    array = [1, 2, 3, 4, 5, 6, 7];
234    spliced = array.splice(0, 100);
235    assertEquals([], array);
236    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
237
238    array = [1, 2, 3, 4, 5, 6, 7];
239    spliced = array.splice(0, 1e100);
240    assertEquals([], array);
241    assertEquals([1, 2, 3, 4, 5, 6, 7], spliced);
242
243    // Some exotic cases.
244    obj = { toString: function() { throw 'Exception'; } };
245
246    // Throwing an exception in conversion:
247    try {
248      [1, 2, 3].splice(obj, 3);
249      throw 'Should have thrown';
250    } catch (e) {
251      assertEquals('Exception', e);
252    }
253
254    try {
255      [1, 2, 3].splice(0, obj, 3);
256      throw 'Should have thrown';
257    } catch (e) {
258      assertEquals('Exception', e);
259    }
260
261    array = [1, 2, 3];
262    array.splice(0, 3, obj);
263    assertEquals(1, array.length);
264
265    // Custom conversion:
266    array = [1, 2, 3];
267    spliced = array.splice({valueOf: function() { return 1; }},
268                           {toString: function() { return 2; }},
269                           'one', 'two');
270    assertEquals([2, 3], spliced);
271    assertEquals([1, 'one', 'two'], array);
272  }
273})();
274
275
276// Nasty: modify the array in ToInteger.
277(function() {
278  var array = [];
279  var spliced;
280
281  for (var i = 0; i < 13; i++) {
282    bad_start = { valueOf: function() { array.push(2*i); return -1; } };
283    bad_count = { valueOf: function() { array.push(2*i + 1); return 1; } };
284    spliced = array.splice(bad_start, bad_count);
285    // According to the spec (15.4.4.12), length is calculated before
286    // performing ToInteger on arguments.  However, v8 ignores elements
287    // we add while converting, so we need corrective pushes.
288    array.push(2*i); array.push(2*i + 1);
289    if (i == 0) {
290      assertEquals([], spliced);  // Length was 0, nothing to get.
291      assertEquals([0, 1], array);
292    } else {
293      // When we start splice, array is [0 .. 2*i - 1], so we get
294      // as a result [2*i], this element is removed from the array,
295      // but [2 * i, 2 * i + 1] are added.
296      assertEquals([2 * i - 1], spliced);
297      assertEquals(2 * i, array[i]);
298      assertEquals(2 * i + 1, array[i + 1]);
299    }
300  }
301})();
302
303// Check the behaviour when approaching maximal values for length.
304(function() {
305  for (var i = 0; i < 7; i++) {
306    try {
307      new Array(Math.pow(2, 32) - 3).splice(-1, 0, 1, 2, 3, 4, 5);
308      throw 'Should have thrown RangeError';
309    } catch (e) {
310      assertTrue(e instanceof RangeError);
311    }
312
313    // Check smi boundary
314    var bigNum = (1 << 30) - 3;
315    var array = new Array(bigNum);
316    array.splice(-1, 0, 1, 2, 3, 4, 5, 6, 7);
317    assertEquals(bigNum + 7, array.length);
318  }
319})();
320
321(function() {
322  for (var i = 0; i < 7; i++) {
323    var a = [7, 8, 9];
324    a.splice(0, 0, 1, 2, 3, 4, 5, 6);
325    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
326    assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
327    assertEquals(undefined, a[10]);
328  }
329})();
330
331(function testSpliceDeleteDouble() {
332  var a = [1.1, 1.2, 1.3, 1.4];
333  a.splice(2, 1)
334  assertEquals([1.1, 1.2, 1.4], a);
335})();
336
337// Past this point the ArrayProtector is invalidated since we modify the
338// Array.prototype.
339
340// Check the case of JS builtin .splice()
341(function() {
342  for (var i = 0; i < 7; i++) {
343    var array = [1, 2, 3, 4];
344    Array.prototype[3] = 'foo';  // To force JS builtin.
345
346    var spliced = array.splice();
347
348    assertEquals([], spliced);
349    assertEquals([1, 2, 3, 4], array);
350  }
351})();
352
353// Now check the case with array of holes and some elements on prototype.
354(function() {
355  var len = 9;
356
357  var at3 = "@3";
358  var at7 = "@7";
359
360  for (var i = 0; i < 7; i++) {
361    var array = new Array(len);
362    var array_proto = [];
363    array_proto[3] = at3;
364    array_proto[7] = at7;
365    array.__proto__ = array_proto;
366
367    var spliced = array.splice(2, 2, 'one', undefined, 'two');
368
369    // Second hole (at index 3) of array turns into
370    // value of Array.prototype[3] while copying.
371    assertEquals([, at3], spliced);
372    assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
373
374    // ... but array[3] and array[7] is actually a hole:
375    assertTrue(delete array_proto[3]);
376    assertEquals(undefined, array[3]);
377    assertTrue(delete array_proto[7]);
378    assertEquals(undefined, array[7]);
379
380    // and now check hasOwnProperty
381    assertFalse(array.hasOwnProperty(0), "array.hasOwnProperty(0)");
382    assertFalse(array.hasOwnProperty(1), "array.hasOwnProperty(1)");
383    assertTrue(array.hasOwnProperty(2));
384    assertTrue(array.hasOwnProperty(3));
385    assertTrue(array.hasOwnProperty(4));
386    assertFalse(array.hasOwnProperty(5), "array.hasOwnProperty(5)");
387    assertFalse(array.hasOwnProperty(6), "array.hasOwnProperty(6)");
388    assertFalse(array.hasOwnProperty(7), "array.hasOwnProperty(7)");
389    assertTrue(array.hasOwnProperty(8));
390    assertFalse(array.hasOwnProperty(9), "array.hasOwnProperty(9)");
391
392    // and now check couple of indices above length.
393    assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
394    assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
395    assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
396    assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
397    assertFalse(array.hasOwnProperty(Math.pow(2, 32) - 2),
398                "array.hasOwnProperty(Math.pow(2, 32) - 2)");
399  }
400})();
401
402// Now check the case with array of holes and some elements on prototype.
403(function() {
404  var len = 9;
405
406  var at3 = "@3";
407  var at7 = "@7";
408
409  for (var i = 0; i < 7; i++) {
410    var array = new Array(len);
411    Array.prototype[3] = at3;
412    Array.prototype[7] = at7;
413
414    var spliced = array.splice(2, 2, 'one', undefined, 'two');
415
416    // Second hole (at index 3) of array turns into
417    // value of Array.prototype[3] while copying.
418    assertEquals([, at3], spliced);
419    assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
420
421    // ... but array[3] and array[7] is actually a hole:
422    assertTrue(delete Array.prototype[3]);
423    assertEquals(undefined, array[3]);
424    assertTrue(delete Array.prototype[7]);
425    assertEquals(undefined, array[7]);
426
427    // and now check hasOwnProperty
428    assertFalse(array.hasOwnProperty(0), "array.hasOwnProperty(0)");
429    assertFalse(array.hasOwnProperty(1), "array.hasOwnProperty(1)");
430    assertTrue(array.hasOwnProperty(2));
431    assertTrue(array.hasOwnProperty(3));
432    assertTrue(array.hasOwnProperty(4));
433    assertFalse(array.hasOwnProperty(5), "array.hasOwnProperty(5)");
434    assertFalse(array.hasOwnProperty(6), "array.hasOwnProperty(6)");
435    assertFalse(array.hasOwnProperty(7), "array.hasOwnProperty(7)");
436    assertTrue(array.hasOwnProperty(8));
437    assertFalse(array.hasOwnProperty(9), "array.hasOwnProperty(9)");
438
439    // and now check couple of indices above length.
440    assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
441    assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
442    assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
443    assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
444    assertFalse(array.hasOwnProperty(Math.pow(2, 32) - 2),
445                "array.hasOwnProperty(Math.pow(2, 32) - 2)");
446  }
447})();
448