Changeset 56425 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Mar 23, 2010, 4:12:10 PM (15 years ago)

Author:

[email protected]

Message:

Reviewed by Geoff Garen.

​https://bugs.webkit.org/show_bug.cgi?id=36511
<rdar://problem/7753498> Safari freezes when using SPUTNIK JavaScript conformance check

Test: fast/js/sputnik-S15.4.4.12_A3_T3.html

• runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncSplice): We were incorrectly computing the start offset, and iterated over (almost) all integers. Note that this can be fixed without using doubles, but the code would be much more complicated, and there is no important reason to stick to integers here.

File:

• trunk/JavaScriptCore/runtime/ArrayPrototype.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -507 +507 @@
     JSArray* resObj = constructEmptyArray(exec);
     JSValue result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+
+    // FIXME: Firefox returns an empty array.
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(0).toUInt32(exec);
-    if (begin < 0)
-        begin = std::max<int>(begin + length, 0);
-    else
-        begin = std::min<int>(begin, length);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toInteger(exec);
+    double relativeBegin = args.at(0).toInteger(exec);
+    unsigned begin;
+    if (relativeBegin < 0) {
+        relativeBegin += length;
+        begin = (relativeBegin < 0) ? 0 : static_cast<unsigned>(relativeBegin);
+    } else
+        begin = std::min<unsigned>(relativeBegin, length);
 
     unsigned deleteCount;
@@ -540 +545 @@
                 thisObj->deleteProperty(exec, k - 1);
         } else {
-            for (unsigned k = length - deleteCount; (int)k > begin; --k) {
+            for (unsigned k = length - deleteCount; k > begin; --k) {
                 if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);