1287521 - Wrong evaluation order in String.prototype.split

Status: RESOLVED FIXED

(Core :: JavaScript: Standard Library, defect)

Description

[André Bargull [:anba]]

ToUint32(limit) needs to be applied before calling ToString(separator).


Test case:
---
"abba".split({
  toString() {
    print("separator-tostring");
    return "b";
  }
}, {
  valueOf() {
    print("limit-valueOf");
    return 0;
  }
});
---

Expected: Prints "limit-valueOf" and then "separator-tostring"
Actual: Prints "separator-tostring" and then "limit-valueOf"

Comment 1

[Tooru Fujisawa [:arai]]

Attachment: Call ToUint32(limit) before ToString(separator) in String.prototype.split.

Moved ToString(separator) to appropriate position.

Comment 2

[Tooru Fujisawa [:arai]]

bug 887016 was landed to firefox48, but backed out from firefox48 by bug 1265307, so this bug affects from firefox49.

Comment 3

[Till Schneidereit [:till]]

Comment on attachment 8772225 [details] [diff] [review]
Call ToUint32(limit) before ToString(separator) in String.prototype.split.

Review of attachment 8772225 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch, thanks.

Comment 4

[Tooru Fujisawa [:arai]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4ddabcdd2919946d54a1b5b06aa1de3d58105723
Bug 1287521 - Call ToUint32(limit) before ToString(separator) in String.prototype.split. r=till

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4ddabcdd2919