Closed
Bug 1287521
Opened 8 years ago
Closed 8 years ago
Wrong evaluation order in String.prototype.split
Categories
(Core :: JavaScript: Standard Library, defect)
Core
JavaScript: Standard Library
Tracking
()
RESOLVED
FIXED
mozilla50
Tracking | Status | |
---|---|---|
firefox48 | --- | unaffected |
firefox49 | --- | affected |
firefox-esr45 | --- | unaffected |
firefox50 | --- | fixed |
People
(Reporter: anba, Assigned: arai)
References
()
Details
Attachments
(1 file)
2.01 KB,
patch
|
till
:
review+
|
Details | Diff | Splinter Review |
ToUint32(limit) needs to be applied before calling ToString(separator). Test case: --- "abba".split({ toString() { print("separator-tostring"); return "b"; } }, { valueOf() { print("limit-valueOf"); return 0; } }); --- Expected: Prints "limit-valueOf" and then "separator-tostring" Actual: Prints "separator-tostring" and then "limit-valueOf"
Assignee | ||
Comment 1•8 years ago
|
||
Moved ToString(separator) to appropriate position.
Assignee: nobody → arai.unmht
Attachment #8772225 -
Flags: review?(till)
Assignee | ||
Updated•8 years ago
|
Assignee | ||
Comment 2•8 years ago
|
||
bug 887016 was landed to firefox48, but backed out from firefox48 by bug 1265307, so this bug affects from firefox49.
Blocks: 887016
status-firefox48:
--- → unaffected
status-firefox49:
--- → affected
status-firefox-esr45:
--- → unaffected
Comment 3•8 years ago
|
||
Comment on attachment 8772225 [details] [diff] [review] Call ToUint32(limit) before ToString(separator) in String.prototype.split. Review of attachment 8772225 [details] [diff] [review]: ----------------------------------------------------------------- Good catch, thanks.
Attachment #8772225 -
Flags: review?(till) → review+
Assignee | ||
Comment 4•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/4ddabcdd2919946d54a1b5b06aa1de3d58105723 Bug 1287521 - Call ToUint32(limit) before ToString(separator) in String.prototype.split. r=till
Comment 5•8 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/4ddabcdd2919
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
You need to log in
before you can comment on or make changes to this bug.
Description
•