8025589: Array.prototype.shift should only copy defined elements in generic mode

Reviewed-by: sundar, attila

1 files changed, 8 insertions, 1 deletions

diff --git a/src/jdk/nashorn/internal/objects/NativeArray.java b/src/jdk/nashorn/internal/objects/NativeArray.java
index 0cdc13a5..fa325753 100644
--- a/src/jdk/nashorn/internal/objects/NativeArray.java
+++ b/src/jdk/nashorn/internal/objects/NativeArray.java
@@ -819,8 +819,15 @@ public final class NativeArray extends ScriptObject {
             if (bulkable(sobj)) {
                 sobj.getArray().shiftLeft(1);
             } else {
+                boolean hasPrevious = true;
                 for (long k = 1; k < len; k++) {
-                    sobj.set(k - 1, sobj.get(k), true);
+                    boolean hasCurrent = sobj.has(k);
+                    if (hasCurrent) {
+                        sobj.set(k - 1, sobj.get(k), true);
+                    } else if (hasPrevious) {
+                        sobj.delete(k - 1, true);
+                    }
+                    hasPrevious = hasCurrent;
                 }
             }
             sobj.delete(--len, true);