Increase test coverage: Array.prototype.splice

Branch coverage:
   Before: 56/78
   After: 78/78

Also found opportunity for optimization, that "else if" branch is not needed,
should be replaced with an "else".

JerryScript-DCO-1.0-Signed-off-by: Mate Dabis mdabis@inf.u-szeged.hu

Author: matedabis

jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c

@@ -1378,8 +1378,9 @@ ecma_builtin_array_prototype_object_splice (ecma_value_t this_arg, /**< this arg
       }
     }
     /* 13. */
-    else if (item_count > delete_count)
+    else
     {
+      JERRY_ASSERT (item_count > delete_count);
       /* 13.b */
       for (k = len - delete_count; k > start  && ecma_is_value_empty (ret_value); k--)
       {

tests/jerry/array-prototype-splice.js

@@ -175,3 +175,228 @@ try {
   assert (e.message === "foo");
   assert (e instanceof ReferenceError);
 }
+
+// Checking behavior when the function's this_argument is undefined
+try {
+  Array.prototype.splice.call(undefined);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when length is an object, which throws error
+try {
+  var o = {};
+  Object.defineProperty(o, 'toString', { 'get' : function() { throw new ReferenceError("foo"); } });
+  var a = { length : o };
+  Array.prototype.splice.call(a);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "foo");
+}
+
+// Checking behavior when the first argument of the function is an object, which throws error
+try {
+  var o = {};
+  Object.defineProperty(o, 'toString', { 'get' : function() { throw new ReferenceError("1"); } });
+  [1, 2].splice(o);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "1");
+}
+
+// Checking behavior when the second argument of the function is an object, which throws error
+try {
+  var o = {};
+  Object.defineProperty(o, 'toString', { 'get' : function() { throw new ReferenceError("2"); } });
+  [1, 2].splice(1, o);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "2");
+}
+
+// Checking behavior when the third element of the array throws error
+try {
+  var a = [1, 5, ,2];
+  Object.defineProperty(a, '2', { 'get' : function() { throw new ReferenceError("3"); } });
+  a.splice(1, 7, 7, 7, 7, 7);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "3");
+}
+
+// Checking behavior when the function's this_argument is an object, witch only contains a length
+var a = {length : 13};
+Array.prototype.splice.call(a, function () { delete a; });
+assert(a.length === 0);
+
+// Checking behavior when the first element of the array throws error
+try {
+  var a = [1, 5, 6, 7, 8, 5];
+  Object.defineProperty(a, '0', { 'get' : function() { throw new ReferenceError("foo0"); } });
+  Array.prototype.splice.call(a, 0, 3);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "foo0");
+}
+
+// Checking behavior when a modified object is an element of the array
+try {
+  f = function()
+      {
+        delete arr[3];
+        arr.length = 13;
+        Object.defineProperty(arr, '5', function() { });
+      };
+  obj = {get: f, valueOf : f, toString: f};
+  arr = [1, 2, obj, 4, 5];
+  Object.defineProperty(arr, '2',{ 'get' : f } );
+  for(var i = 0; i < arr.length; i++)
+  {
+    var a = arr[i];
+  }
+  arr.splice(1, 4, obj);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when a modified object is an element of the array and deletes the elements
+try {
+  f = function()
+      {
+        for(var i = 0; i < arr.length; i++)
+        {
+          delete arr[i];
+        }
+      };
+  obj = {get: f, valueOf : f, toString: f };
+  arr = [1, 2, obj, 4, 5];
+  for(var i = 0; i < 6; i++)
+  {
+    Object.defineProperty(arr, i, { 'get' : f });
+  }
+  arr.splice(1, 3, obj);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when an element of the array throws error
+try {
+  f = function() { throw new TypeError("4"); };
+  obj = {get: f, valueOf : f, toString: f};
+  arr = [1, 2, obj, 4, 5];
+  Object.defineProperty(arr, '4', { 'get' : f });
+  arr.splice(1, 3, obj);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+  assert(e.message == "4");
+}
+
+// Checking behavior when elements are getting deleted by an element wich only has a get function
+try{
+  f = function()
+      {
+        for(var i = 0; i < arr.length; i++)
+        {
+           delete arr[i];
+        }
+      };
+  arr = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
+  delete arr[2];
+  Object.defineProperty(arr, '2', { 'get' : f });
+  arr.splice(1, 7, 5);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when the issue is the same as above, but splice has more arguments
+try {
+  f = function()
+      {
+        for(var i = 0; i < arr.length; i++)
+        {
+          delete arr[i];
+        }
+      };
+  arr = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11];
+  delete arr[2];
+  Object.defineProperty(arr, '2', { 'get' : f });
+  arr.splice(1, 7, 5, 5, 5, 5);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+
+// Checking behavior when first 3 elements throw error
+try {
+  var a = [1, 5, 6, 7, 8, 5];
+  Object.defineProperty(a, '1', { 'get' : function() { throw new ReferenceError("foo1"); } });
+  Object.defineProperty(a, '0', { 'get' : function() { throw new ReferenceError("foo0"); } });
+  Object.defineProperty(a, '2', { 'get' : function() { throw new ReferenceError("foo2"); } });
+  Array.prototype.splice.call(a, 0, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3);
+  assert(false);
+} catch (e) {
+  assert(e instanceof ReferenceError);
+  assert(e.message == "foo0");
+}
+
+// Checking behavior when the last element throws error
+try {
+  f = function()
+      {
+        for(var i = 0; i < arr.length; i++)
+        {
+           delete arr[i];
+        }
+      };
+  arr = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24];
+  delete arr[23];
+  Object.defineProperty(arr, '23', { 'get' : f });
+  arr.splice(1, 7, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when a yet non existing element will throw an error
+try {
+  f = function () { throw new TypeError("6");};
+  arr = [1, 2, 4, 5];
+  Object.defineProperty(arr, '4',{ 'get' : f });
+  arr.splice(1, 2, 3, 4, 5, 6, 7, 8, 9, 10);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+  assert(e.message == "6");
+}
+
+// Checking behavior when the last element gets deleted
+try {
+  f = function () { delete arr[23]; };
+  arr = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24];
+  delete arr[23];
+  Object.defineProperty(arr, '23', { 'get' : f });
+  arr.splice(1, 7, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}
+
+// Checking behavior when the array is empty, large, and not writable
+try {
+  arr = [];
+  Object.defineProperty(arr, 'length', { value : 999, writable: false });
+  arr.splice(1, 2, 4, 5);
+  assert(false);
+} catch (e) {
+  assert(e instanceof TypeError);
+}