577757 - array[-1073741824] != array['-1073741824']

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Daniel Rice]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4

According to ECMA 262, section 15.4 it should be possible to access array elements equivalently with a number or a string representation of the same number as long as the number is between 

>>> var arr = []
>>> arr[17] = 'seventeen'
"seventeen"
>>> arr['17']
"seventeen"

This fails for -2^30 = -1073741824
>>> arr[-1073741824] = 'minus 2^30'
"minus 2^30"
>>> arr['-1073741824']
(no result)


Reproducible: Always

Steps to Reproduce:
1. Open the firebug console
2. Enter: var x = []; x[-1073741824] = 'aa'
3. Enter: x['-1073741824'].length
Actual Results:  
Get message:

TypeError: arr['-1073741824'] is undefined {  message="arr['-1073741824'] is undefined",  more...}

Expected Results:  
Should get the value 2 for the length of the string 'aa'

I've run a loop on all integer multiples of 1024 and all values besides -1073741824 work fine.

Comment 1

[Daniel Rice]

(In reply to comment #0)
Ignore the text "as long as the number is between"

Comment 2

[Jeff Walden [:Waldo]]

I'll take a look at this "shortly".  I'm guessing it's an off-by-one error in js_CheckForStringIndex or whatever it's named.

Comment 3

[Igor Bukanov]

This is a regression from the bug 432881.

Comment 4

[Jeff Walden [:Waldo]]

Attachment: Patch, update existing test which *should* have revealed this bug if it had tested fenceposts

Lots of interesting history-diving done researching this, didn't know (remember?) integral jsids were once constrained to the symmetric range [-1073741823, 1073741823].

Too bad bug 57043's tests didn't check obvious integer-range fenceposts (I don't consider -0 obvious, but had the test at the time included it it would have tested -- and revealed -- yet another bug in the check-for-string-index algorithm), else it would have prevented this bug's introduction.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 480013 [details] [diff] [review]
Patch, update existing test which *should* have revealed this bug if it had tested fenceposts

Bouncing, I flunked review last time on Igor's patch and he wrote that patch, so he's _heir apparent_. FWIW this looks correct to me, and the test vector is now righteous.

/be

Comment 6

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/958ac4ba3833

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/958ac4ba3833