Changeset 5565 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Nov 17, 2003, 9:40:43 PM (22 years ago)

Author:

mjs

Message:

Patch from Harri, reviewed by me.

• fixed 3487375 - backwards array slice causes infinite loop

• kjs/array_object.cpp: (ArrayProtoFuncImp::call):

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (3 diffs)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -579 +579 @@
     Object resObj = Object::dynamicCast(exec->interpreter()->builtinArray().construct(exec,List::empty()));
     result = resObj;
-    int begin = args[0].toUInt32(exec);
+    int begin = args[0].toInteger(exec);
     if ( begin < 0 )
       begin = maxInt( begin + length, 0 );
@@ -587 +587 @@
     if (args[1].type() != UndefinedType)
     {
-      end = args[1].toUInt32(exec);
+      end = args[1].toInteger(exec);
       if ( end < 0 )
         end = maxInt( end + length, 0 );
@@ -595 +595 @@
 
     //printf( "Slicing from %d to %d \n", begin, end );
-    for(unsigned int k = 0; k < (unsigned int) end-begin; k++) {
-      if (thisObj.hasProperty(exec,k+begin)) {
-        Value obj = thisObj.get(exec, k+begin);
-        resObj.put(exec, k, obj);
-      }
-    }
-    resObj.put(exec, lengthPropertyName, Number(end - begin), DontEnum | DontDelete);
+    int n = 0;
+    for(int k = begin; k < end; k++, n++) {
+      if (thisObj.hasProperty(exec, k)) {
+        Value obj = thisObj.get(exec, k);
+        resObj.put(exec, n, obj);
+      }
+    }
+    resObj.put(exec, lengthPropertyName, Number(n), DontEnum | DontDelete);
     break;
   }