From 3186de63794173c9bfc674389dd0d67d94cba7d2 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Mon, 8 Jul 2013 03:24:54 -0700
Subject: [PATCH] Bug 881574 - Part 1: Support Array.length in GetPropertyPure.
 (r=bhackett)

---
 js/src/jscntxt.h |  3 +--
 js/src/jsobj.cpp | 19 ++++++++++++-------
 js/src/jsobj.h   |  6 +++---
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index c77aba3d9a0e..326640d58aac 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -1656,6 +1656,7 @@ struct ThreadSafeContext : js::ContextFriendFields,
 
     /* Cut outs for string operations. */
     StaticStrings &staticStrings() { return runtime_->staticStrings; }
+    JSAtomState &names() { return runtime_->atomState; }
 
     /*
      * Allocator used when allocating GCThings on this context. If we are a
@@ -1949,8 +1950,6 @@ struct JSContext : js::ThreadSafeContext,
         exception.setUndefined();
     }
 
-    JSAtomState & names() { return runtime()->atomState; }
-
 #ifdef DEBUG
     /*
      * Controls whether a quadratic-complexity assertion is performed during
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index c5c19c69b73d..1b353bac26df 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -4169,25 +4169,22 @@ js::LookupPropertyPure(JSObject *obj, jsid id, JSObject **objp, Shape **propp)
  *
  *  - Any object in the lookup chain has a non-stub resolve hook.
  *  - Any object in the lookup chain is non-native.
- *  - Hashification of a shape tree into a shape table.
  *  - The property has a getter.
  */
 bool
-js::GetPropertyPure(JSObject *obj, jsid id, Value *vp)
+js::GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, jsid id, Value *vp)
 {
     JSObject *obj2;
     Shape *shape;
     if (!LookupPropertyPureInline(obj, id, &obj2, &shape))
         return false;
 
-    /*
-     * If we couldn't find the property, fail if any of the following edge
-     * cases appear.
-     */
     if (!shape) {
-        /* Do we have a non-stub class op hook? */
+        /* Fail if we have a non-stub class op hook? */
         if (obj->getClass()->getProperty && obj->getClass()->getProperty != JS_PropertyStub)
             return false;
+
+        /* Vanilla native object, return undefined. */
         vp->setUndefined();
         return true;
     }
@@ -4197,6 +4194,14 @@ js::GetPropertyPure(JSObject *obj, jsid id, Value *vp)
         return true;
     }
 
+    /* Special case 'length' on Array. */
+    if (obj->is<ArrayObject>() &&
+        (JSID_IS_ATOM(id) && tcx->names().length == JSID_TO_ATOM(id)))
+    {
+        vp->setNumber(obj->as<ArrayObject>().length());
+        return true;
+    }
+
     return NativeGetPureInline(obj2, shape, vp);
 }
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 5c397c7f0f3f..72a5ca3fa356 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1420,12 +1420,12 @@ bool
 LookupPropertyPure(JSObject *obj, jsid id, JSObject **objp, Shape **propp);
 
 bool
-GetPropertyPure(JSObject *obj, jsid id, Value *vp);
+GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, jsid id, Value *vp);
 
 inline bool
-GetPropertyPure(JSObject *obj, PropertyName *name, Value *vp)
+GetPropertyPure(ThreadSafeContext *tcx, JSObject *obj, PropertyName *name, Value *vp)
 {
-    return GetPropertyPure(obj, NameToId(name), vp);
+    return GetPropertyPure(tcx, obj, NameToId(name), vp);
 }
 
 bool