Closed
Bug 577757
Opened 14 years ago
Closed 14 years ago
array[-1073741824] != array['-1073741824']
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: rice, Assigned: Waldo)
References
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 According to ECMA 262, section 15.4 it should be possible to access array elements equivalently with a number or a string representation of the same number as long as the number is between >>> var arr = [] >>> arr[17] = 'seventeen' "seventeen" >>> arr['17'] "seventeen" This fails for -2^30 = -1073741824 >>> arr[-1073741824] = 'minus 2^30' "minus 2^30" >>> arr['-1073741824'] (no result) Reproducible: Always Steps to Reproduce: 1. Open the firebug console 2. Enter: var x = []; x[-1073741824] = 'aa' 3. Enter: x['-1073741824'].length Actual Results: Get message: TypeError: arr['-1073741824'] is undefined { message="arr['-1073741824'] is undefined", more...} Expected Results: Should get the value 2 for the length of the string 'aa' I've run a loop on all integer multiples of 1024 and all values besides -1073741824 work fine.
Reporter | ||
Comment 1•14 years ago
|
||
(In reply to comment #0) Ignore the text "as long as the number is between"
Updated•14 years ago
|
Status: UNCONFIRMED → NEW
Ever confirmed: true
Assignee | ||
Comment 2•14 years ago
|
||
I'll take a look at this "shortly". I'm guessing it's an off-by-one error in js_CheckForStringIndex or whatever it's named.
Assignee: general → jwalden+bmo
Assignee | ||
Comment 4•14 years ago
|
||
Lots of interesting history-diving done researching this, didn't know (remember?) integral jsids were once constrained to the symmetric range [-1073741823, 1073741823]. Too bad bug 57043's tests didn't check obvious integer-range fenceposts (I don't consider -0 obvious, but had the test at the time included it it would have tested -- and revealed -- yet another bug in the check-for-string-index algorithm), else it would have prevented this bug's introduction.
Attachment #480013 -
Flags: review?(brendan)
Assignee | ||
Updated•14 years ago
|
Status: NEW → ASSIGNED
Comment 5•14 years ago
|
||
Comment on attachment 480013 [details] [diff] [review] Patch, update existing test which *should* have revealed this bug if it had tested fenceposts Bouncing, I flunked review last time on Igor's patch and he wrote that patch, so he's _heir apparent_. FWIW this looks correct to me, and the test vector is now righteous. /be
Attachment #480013 -
Flags: review?(brendan) → review?(igor)
Updated•14 years ago
|
Attachment #480013 -
Flags: review?(igor) → review+
Assignee | ||
Comment 6•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/958ac4ba3833
Whiteboard: fixed-in-tracemonkey
Comment 7•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/958ac4ba3833
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•