452993 - js_concat not working correctly when the attached item is a Array object.

Status: RESOLVED WORKSFORME

(Rhino Graveyard :: Core, defect)

Description

[Avdpro Pang]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; zh-CN; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16
Build Identifier: 1.7

var a=[];
var b=[1,2,3,4,5,6,7,8,9,10,11,12];
a.concat(b);
above codes will cause a Array out of bounds Java exception.
I roughly looked into the codes, i found there maybe a problem in NativeArray.js_concat function:
When caculating the new array's length, it fails to know the args[0] is a Aarray by using a really complex way (by calling checking the protos if args[i] have the ctor). But when do the realy concat work, it just using "if (args[i] instanceof NativeArray)".
I think use "if (args[i] instanceof NativeArray)" to caculate the new length is good enough, i changed it then it works fine.

Reproducible: Always

Steps to Reproduce:
var a=[];
var b=[1,2,3,4,5,6,7,8,9,10,11,12];
a.concat(b);
Actual Results:  
above codes will cause a Array out of bounds Java exception.

Expected Results:  
codes works

I roughly looked into the codes, i found there maybe a problem in NativeArray.js_concat function:
When caculating the new array's length, it fails to know the args[0] is a Aarray by using a really complex way (by calling checking the protos if args[i] have the ctor). But when do the realy concat work, it just using "if (args[i] instanceof NativeArray)".
I think use "if (args[i] instanceof NativeArray)" to caculate the new length is good enough, i changed it then it works fine.

Comment 1

[Marc]

For me, with current Rhino sources from SVN head, the provided example doesn't cause any exception.

Comment 2

[Norris Boyd]

Yes, works for me as well.