js_concat not working correctly when the attached item is a Array object.

RESOLVED WORKSFORME

Status

RESOLVED WORKSFORME
10 years ago
10 years ago

People

(Reporter: avdpro.px, Unassigned)

Tracking

Details

(Reporter)

Description

10 years ago
User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; zh-CN; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16
Build Identifier: 1.7

var a=[];
var b=[1,2,3,4,5,6,7,8,9,10,11,12];
a.concat(b);
above codes will cause a Array out of bounds Java exception.
I roughly looked into the codes, i found there maybe a problem in NativeArray.js_concat function:
When caculating the new array's length, it fails to know the args[0] is a Aarray by using a really complex way (by calling checking the protos if args[i] have the ctor). But when do the realy concat work, it just using "if (args[i] instanceof NativeArray)".
I think use "if (args[i] instanceof NativeArray)" to caculate the new length is good enough, i changed it then it works fine.

Reproducible: Always

Steps to Reproduce:
var a=[];
var b=[1,2,3,4,5,6,7,8,9,10,11,12];
a.concat(b);
Actual Results:  
above codes will cause a Array out of bounds Java exception.

Expected Results:  
codes works

I roughly looked into the codes, i found there maybe a problem in NativeArray.js_concat function:
When caculating the new array's length, it fails to know the args[0] is a Aarray by using a really complex way (by calling checking the protos if args[i] have the ctor). But when do the realy concat work, it just using "if (args[i] instanceof NativeArray)".
I think use "if (args[i] instanceof NativeArray)" to caculate the new length is good enough, i changed it then it works fine.

Comment 1

10 years ago
For me, with current Rhino sources from SVN head, the provided example doesn't cause any exception.

Comment 2

10 years ago
Yes, works for me as well.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.