Changeset 29459 in webkit for trunk/JavaScriptCore

Timestamp:

Jan 14, 2008, 1:12:18 AM (17 years ago)

Author:

[email protected]

Message:

Reviewed by David Kilzer.

​http://bugs.webkit.org/show_bug.cgi?id=16787
array.splice() with 1 element not working

Test: fast/js/array-splice.html

• kjs/array_object.cpp: (KJS::ArrayProtoFuncSplice::callAsFunction): Implement this Mozilla extension, and fix some other edge cases.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• kjs/array_object.cpp (modified) (2 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-01-14  Alexey Proskuryakov  <[email protected]>
+
+        Reviewed by David Kilzer.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16787
+        array.splice() with 1 element not working
+
+        Test: fast/js/array-splice.html
+
+        * kjs/array_object.cpp:
+        (KJS::ArrayProtoFuncSplice::callAsFunction): Implement this Mozilla extension, and fix
+        some other edge cases.
+
 2008-01-13  Steve Falkenburg  <[email protected]>
 

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -431 +431 @@
     JSValue* result = resObj;
     unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    if (!args.size())
+        return jsUndefined();
     int begin = args[0]->toUInt32(exec);
     if (begin < 0)
@@ -436 +438 @@
     else
         begin = std::min<int>(begin, length);
-    unsigned int deleteCount = std::min<int>(std::max<int>(args[1]->toUInt32(exec), 0), length - begin);
+
+    unsigned int deleteCount;
+    if (args.size() > 1)
+        deleteCount = std::min<int>(std::max<int>(args[1]->toUInt32(exec), 0), length - begin);
+    else
+        deleteCount = length - begin;
 
     for (unsigned int k = 0; k < deleteCount; k++) {