Changeset 7047 in webkit for trunk/JavaScriptCore/kjs/array_object.cpp

Timestamp:

Jul 16, 2004, 3:56:24 PM (21 years ago)

Author:

sullivan

Message:

Reviewed by Maciej.

• fixed <rdar://problem/3714644> REGRESSION (125.8-146): bugzilla submit link hangs browser with javascript

• kjs/array_object.cpp: (ArrayProtoFuncImp::call): Check for undefined type for args[0] the same way we were already checking for args[1]. In this case, args was zero-length, but we were treating args[0] like an integer anyway. Resulted in some code looping from a NAN value to 4, taking approximately forever.

• JavaScriptCore.pbproj/project.pbxproj: version wars

File:

• trunk/JavaScriptCore/kjs/array_object.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/array_object.cpp

@@ -581 +581 @@
     Object resObj = Object::dynamicCast(exec->lexicalInterpreter()->builtinArray().construct(exec,List::empty()));
     result = resObj;
-    double begin = args[0].toInteger(exec);
-    if (begin < 0) {
-      begin += length;
-      if (begin < 0)
-        begin = 0;
-    } else {
-      if (begin > length)
-        begin = length;
+    double begin = 0;
+    if (args[0].type() != UndefinedType) {
+        begin = args[0].toInteger(exec);
+        if (begin < 0) {
+            begin += length;
+            if (begin < 0)
+                begin = 0;
+        } else {
+            if (begin > length)
+                begin = length;
+        }
     }
     double end = length;