Closed Bug 1171036 Opened 5 years ago Closed 5 years ago

Change GetLengthProperty slow path to use ToLengthClamped instead of ToUint32.

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla42
Tracking Status
firefox42 --- fixed

People

(Reporter: jorendorff, Assigned: jorendorff)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

No description provided.
Assignee: nobody → jorendorff
Status: NEW → ASSIGNED
Comment on attachment 8614696 [details] [diff] [review]
Change GetLengthProperty slow path to use ToLengthClamped instead of ToUint32

Review of attachment 8614696 [details] [diff] [review]:
-----------------------------------------------------------------

Add the 924058 reference as a comment by GetLengthProperty's declaration somewhere, or something?

::: js/src/tests/ecma_5/Array/unshift-01.js
@@ +13,5 @@
>   * BEGIN TEST *
>   **************/
>  
> +// ES6 ToLength clamps length values to 2^53 - 1.
> +// We currently clamp to 2^32 - 1 instead. See bug 924058.

Isn't the limit we enforce actually 2**32 - 2?  Probably need to change MAX_LENGTH here, too, right?
Attachment #8614696 - Flags: review?(jwalden+bmo) → review+
sorry had to back this out in https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=65e6e21a4725 i think that something in this push caused test failures like https://treeherder.mozilla.org/logviewer.html#?job_id=10872015&repo=mozilla-inbound
Flags: needinfo?(jorendorff)
https://hg.mozilla.org/mozilla-central/rev/f2d4369c7128
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
Flags: needinfo?(jorendorff)
You need to log in before you can comment on or make changes to this bug.