Changeset 4630 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Jul 12, 2003, 9:01:36 AM (22 years ago)

Author:

darin

Message:

Reviewed by Dave.

• fixed 3272777 -- array object indices treated as integers by Safari, but as strings in other web browsers

JavaScriptCore did not implement the proper rule for what an array index is.

• kjs/array_object.cpp: (getArrayIndex): Added. Implements the rule from the specification, which also provides a handy "not an array index" value of 2^{32-1. (ArrayInstanceImp::get): Use getArrayIndex. (ArrayInstanceImp::put): Ditto. (ArrayInstanceImp::hasProperty): Ditto. (ArrayInstanceImp::setLength): Ditto.}

• kjs/identifier.h: Removed now-unused toULong, and added toStrictUInt32, in both cases forwarding functions that forward to UString.

• kjs/ustring.h: Added toStringUInt32.
• kjs/ustring.cpp: (UString::toStrictUInt32): Added. Converts a string to a 32-bit unsigned integer, and rejects any string that does not exactly match the way the integer would be formatted on output. This is the rule documented in the ECMA language standard.

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (5 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -71 +71 @@
 }
 
+// Rule from ECMA 15.2 about what an array index is.
+// Must exactly match string form of an unsigned integer, and be less than 2^32 - 1.
+
+const unsigned maxUInt32 = 0xFFFFFFFFU;
+const unsigned notArrayIndex = maxUInt32;
+
+unsigned getArrayIndex(const Identifier &propertyName)
+{
+  bool ok;
+  unsigned index = propertyName.toStrictUInt32(&ok);
+  if (!ok || index >= maxUInt32)
+    return notArrayIndex;
+  return index;
+}
+
 Value ArrayInstanceImp::get(ExecState *exec, const Identifier &propertyName) const
 {
@@ -76 +91 @@
     return Number(length);
 
-  bool ok;
-  unsigned index = propertyName.toULong(&ok);
-  if (ok) {
+  unsigned index = getArrayIndex(propertyName);
+  if (index != notArrayIndex) {
     if (index >= length)
       return Undefined();
@@ -110 +124 @@
   }
   
-  bool ok;
-  unsigned index = propertyName.toULong(&ok);
-  if (ok) {
+  unsigned index = getArrayIndex(propertyName);
+  if (index != notArrayIndex) {
     put(exec, index, value, attr);
     return;
@@ -144 +157 @@
     return true;
   
-  bool ok;
-  unsigned index = propertyName.toULong(&ok);
-  if (ok) {
+  unsigned index = getArrayIndex(propertyName);
+  if (index != notArrayIndex) {
     if (index >= length)
       return false;
@@ -253 +265 @@
     while (it != sparseProperties.end()) {
       Reference ref = it++;
-      bool ok;
-      if (ref.getPropertyName(exec).toULong(&ok) > newLength) {
+      unsigned index = getArrayIndex(ref.getPropertyName(exec));
+      if (index != notArrayIndex && index > newLength) {
         ref.deleteValue(exec);
       }