1171036 - Change GetLengthProperty slow path to use ToLengthClamped instead of ToUint32.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[Jason Orendorff [:jorendorff]]

Attachment: Change GetLengthProperty slow path to use ToLengthClamped instead of ToUint32

Comment 2

[Jeff Walden [:Waldo]]

Comment on attachment 8614696 [details] [diff] [review]
Change GetLengthProperty slow path to use ToLengthClamped instead of ToUint32

Review of attachment 8614696 [details] [diff] [review]:
-----------------------------------------------------------------

Add the 924058 reference as a comment by GetLengthProperty's declaration somewhere, or something?

::: js/src/tests/ecma_5/Array/unshift-01.js
@@ +13,5 @@
>   * BEGIN TEST *
>   **************/
>  
> +// ES6 ToLength clamps length values to 2^53 - 1.
> +// We currently clamp to 2^32 - 1 instead. See bug 924058.

Isn't the limit we enforce actually 2**32 - 2?  Probably need to change MAX_LENGTH here, too, right?

Comment 3

[Jason Orendorff [:jorendorff]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ae05fa14e1f0

Comment 4

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9345403c7628

Comment 5

[Pulsebot]

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a74edde76e5d

Comment 6

[Carsten Book [:Tomcat]]

sorry had to back this out in https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=65e6e21a4725 i think that something in this push caused test failures like https://treeherder.mozilla.org/logviewer.html#?job_id=10872015&repo=mozilla-inbound

Comment 7

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f2d4369c7128

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f2d4369c7128