勿乱动arguments对象

此题是看到51js论坛上有人提出这个问题：求解arguments对象的内部实现原理

真正不在于提的问题本身，而在于不同的浏览器对它的实现并不完全一致。直接上代码了：

function chrome_bug(a, b) {
       arguments[1] = 2;
       alert(b); // Chrome:2, other:undefined
}

chrome_bug(1);

到底是chrome的bug还是其它浏览器实现的并不“标准”呢？还是翻翻标准…

关于Arguments Object (证明chrome是接近标准的，其它浏览器不知道为何没这么实现~ ~)

10.1.8 Arguments Object

When control enters an execution context for function code, an arguments object is created and initialised as follows:

• The value of the internal [[Prototype]] property of the arguments object is the original Object prototype object, the one that is the initial value of Object.prototype (see 15.2.3.1).
• A property is created with name callee and property attributes { DontEnum }. The initial value of this property is the Function object being executed. This allows anonymous functions to be recursive.
• A property is created with name length and property attributes { DontEnum }. The initial value of this property is the number of actual parameter values supplied by the caller.
• For each non-negative integer, arg, less than the value of the length property, a property is created with name ToString(arg) and property attributes { DontEnum }. The initial value of this property is the value of the corresponding actual parameter supplied by the caller. The first actual parameter value corresponds to arg = 0, the second to arg = 1, and so on. In the case when arg is less than the number of formal parameters for the Function object, this property shares its value with the corresponding property of the activation object. This means that changing this property changes the corresponding property of the activation object and vice versa.

再来几个例子：

<script type='text/javascript'>
    ~function(a){
        var a= 'false';
        alert(arguments[0]);//都输出'false'
    }(true);
</script>

<script type='text/javascript'>
    ~function(a){
        Array.prototype.splice.call(arguments,0,1);
        alert(a);//chrome为'undefined' 其它浏览器为 1
    }(1);
</script>

 

<script type='text/javascript'>
    ~function(a, b) {
        arguments[1] = 2;
        alert(b);//chrome为2 其它浏览器为'undefined'
    }(1);
</script>

从上面几个例子上看，感觉chrome中arguments[1]的引用指向了实参，改变arguments[1]或是b都将互相影响，验证一把：

<script type='text/javascript'>
    ~function(a, b) {
        arguments[1] = 2;
        b = 3;
        alert(arguments[1]);//chrome为3 其它浏览器为2
    }(1);
</script>

既然发现浏览器间的实现不完全一致，所以还是觉得在开发少折腾arguments对象了。

好吧，想前之前好像在本机编译过v8的源码，翻出来看看（不过c++差不多已经还给老师了，本来就没学好~ ~！！有空再恶补一下）

在v8_base的src目录下找到了“arguments.h”头文件：

// Copyright 2006-2008 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
//
//     * Redistributions of source code must retain the above copyright
//       notice, this list of conditions and the following disclaimer.
//     * Redistributions in binary form must reproduce the above
//       copyright notice, this list of conditions and the following
//       disclaimer in the documentation and/or other materials provided
//       with the distribution.
//     * Neither the name of Google Inc. nor the names of its
//       contributors may be used to endorse or promote products derived
//       from this software without specific prior written permission.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#ifndef V8_ARGUMENTS_H_
#define V8_ARGUMENTS_H_

namespace v8 {
namespace internal {

// Arguments provides access to runtime call parameters.
//
// It uses the fact that the instance fields of Arguments
// (length_, arguments_) are "overlayed" with the parameters
// (no. of parameters, and the parameter pointer) passed so
// that inside the C++ function, the parameters passed can
// be accessed conveniently:
//
//   Object* Runtime_function(Arguments args) {
//     ... use args[i] here ...
//   }

class Arguments BASE_EMBEDDED {
 public:
  Arguments(int length, Object** arguments)
      : length_(length), arguments_(arguments) { }

  Object*& operator[] (int index) {
    ASSERT(0 <= index && index < length_);
    return arguments_[-index];
  }

  template <class S> Handle<S> at(int index) {
    Object** value = &((*this)[index]);
    // This cast checks that the object we're accessing does indeed have the
    // expected type.
    S::cast(*value);
    return Handle<S>(reinterpret_cast<S**>(value));
  }

  // Get the total number of arguments including the receiver.
  int length() const { return length_; }

  Object** arguments() { return arguments_; }

 private:
  int length_;
  Object** arguments_;
};


// Cursom arguments replicate a small segment of stack that can be
// accessed through an Arguments object the same way the actual stack
// can.
class CustomArguments : public Relocatable {
 public:
  inline CustomArguments(Object* data,
                         JSObject* self,
                         JSObject* holder) {
    values_[3] = self;
    values_[2] = holder;
    values_[1] = Smi::FromInt(0);
    values_[0] = data;
  }
  void IterateInstance(ObjectVisitor* v);
  Object** end() { return values_ + 3; }
 private:
  Object* values_[4];
};


} }  // namespace v8::internal

#endif  // V8_ARGUMENTS_H_

本文参考：

Google Chrome雷区之二－－莫动arguments对象

ECMAScript Language Specification

V8 JavaScript Engine