57045 - negative integers as object properties: weird behavior

Status: VERIFIED FIXED

(Rhino Graveyard :: Core, defect, P3)

Description

[David Flanagan]

When I use a negative integer as an object property name (is this
even legal?) I get weird behavior with the latest rhinoTip.  The following
js shell session illustrates.  Note that this does not occur with
non-negative integers, or any floating-point values.

Note that this is very similar to, but not quite the same behavior
as that reported against spidermonkey in bug #57043

oxymoron:7 % java -jar rhinoTip/js.jar
js> var o = new Object();
js>  o[-1] = "number";
number
js>  o[-1]
number
js> o["-1"]
js>  o["-1"] = "string";   
string
js> o[-1]
number
js> o["-1"]
string
js> for(i in o) print(i + ": " + typeof i + ": " + o[i]);
-1: number: number
-1: string: string

Comment 1

[Phil Schwartau]

Compare bug 57043 in JS Engine -

Comment 2

[Patrick C. Beard]

This seems to treat -1 and "-1" as distinct keys.

Comment 3

[Norris Boyd]

I have a fix for this. I'll run regression tests.

Comment 4

[Norris Boyd]

Special processing of integers as strings wasn't handling negative integers.

Comment 5

[Phil Schwartau]

Verified on Linux and WinNT via this testcase added to JS test suite:

                js/tests/js1_5/Regress/regress-57043.js