Support Array + documentElement+childNodes + nodeType in DOM [jQuery]

[GoogleCodeExporter]

The new JavaScript interpreter unmasks the fact that we don't handle this
properly. The expressions

[full]
try{Array.prototype.slice.call(s.documentElement.childNodes,0)[0].nodeType}
[min]
try{Array.prototype.slice.call(s.documentElement.childNodes,0)}

would always throw an exception in 9.0/9.0.4/9.1 because neither parse, so
jQuery would fall back on a compatibility routine for makeArray (called z
in jQuery.min).

In 9.2, both expressions parse, but only the [full] throws the exception
and for an entirely different reason, namely that we don't support that in
DOM. We didn't before, but the fallback saved our butt. The [min] will
actually parse and APPEAR to succeed, but fail later because the fallback
never gets executed, which covers our DOM gap.

This needs to be solved for 9.2, because jQuery.min is ubiquitous.

Original issue reported on code.google.com by classi...@floodgap.com on 17 May 2010 at 6:47

[GoogleCodeExporter]

The problem seems to be what we get back from childNodes.

this works:
javascript:alert(Array.prototype.slice.call(new Array("one", "two"), 1)) // two
javascript:alert(new Array("one", "two").slice(1)) // two 
javascript:alert(window.document.documentElement.childNodes) // object NodeList
javascript:alert(window.document.documentElement.childNodes[0]) // object 
HTMLHeadElement

this doesn't:
javascript:alert(window.document.documentElement.childNodes.slice(0)) // should 
be
also HTMLHeadElement, but is undefined

The expression succeeds, but doesn't actually work. In "full" we go on to try to
reference the Array we are expecting to get, but don't, hence the exception.

Original comment by classi...@floodgap.com on 17 May 2010 at 5:42

[GoogleCodeExporter]

JavaScript in 9.1 returns a sliced object for
Array.prototype.slice.call(s.documentElement.childNodes,0) and 9.2-internal 
doesn't.
We probably need to relax some checks in jsarray.c and add compiler warnings to 
back
them out later.

Original comment by classi...@floodgap.com on 17 May 2010 at 10:06

[GoogleCodeExporter]

It appears our version of the DOM does not use property tags in the way 
SpiderMonkey
expects. This fixes the problem, in jsarray.c::GetArrayElement:

    if (!prop) {
// Classilla issue 118
#if(0)
        *hole = JS_TRUE;
        *vp = JSVAL_VOID;
        goto out;
#else
#warning !!!KLUDGE ALERT!!! we are handling properties a la old JavaScript
        // We don't drop the property -- there's no property to drop.
        goto gimmeprop;
#endif
// end issue
    }
    OBJ_DROP_PROPERTY(cx, obj2, prop);
  gimmeprop:
    if (!OBJ_GET_PROPERTY(cx, obj, id, vp)) {

This is clearly a kludgy solution, but it seems to be perfectly stable, and 
sites now
work extremely well.

Original comment by classi...@floodgap.com on 17 May 2010 at 11:25

[GoogleCodeExporter]

Original comment by classi...@floodgap.com on 17 May 2010 at 11:26

• Changed state: Verified