Changeset 11775 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Dec 27, 2005, 3:07:49 AM (19 years ago)

Author:

mjs

Message:

JavaScriptCore:

Reviewed and landed by Maciej.

• fixed 6234: Can delete array index property incorrectly. ​http://bugzilla.opendarwin.org/show_bug.cgi?id=6234

• kjs/array_object.cpp: (ArrayInstance::deleteProperty): use toArrayIndex instead of toUInt32 when looking for array properties.

LayoutTests:

Reviewed, tweaked and landed by Maciej.

• test case for 6234: Can delete array index property incorrectly. ​http://bugzilla.opendarwin.org/show_bug.cgi?id=6234

• fast/js/array-float-delete.html: Added.

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -162 +162 @@
   
   bool ok;
-  uint32_t index = propertyName.toUInt32(&ok);
+  uint32_t index = propertyName.toArrayIndex(&ok);
   if (ok) {
     if (index >= length)