[Webkit-unassigned] [Bug 6234] New: Can delete array index property incorrectly.

[bugzilla-daemon at opendarwin.org]

http://bugzilla.opendarwin.org/show_bug.cgi?id=6234

           Summary: Can delete array index property incorrectly.
           Product: WebKit
           Version: 412+
          Platform: Other
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: JavaScript
        AssignedTo: webkit-unassigned at opendarwin.org
        ReportedBy: maksim at kde.org


See the following testcase:  
var a = new Array();  
a[1]     = 4;  
a['1.0'] = 5;  
delete a['1.0'];  
alert(a[1]);  
  
here, the alert at the end should IMHO return 4 (which FFox, WinIE, and Konq 
3.5 all do), and not Undefined as JSC seems to produce, as the property 1.0 
being  removed is not an array index (toString(toUint32('1.0')) != '1.0)  
  
I believe the following is the fix: 
--- array_object.cpp    (revision 489699)   
+++ array_object.cpp    (working copy)   
@@ -160,7 +160,7 @@ bool ArrayInstanceImp::deleteProperty(Ex   
     return false;   
   
   bool ok;   
-  uint32_t index = propertyName.toUInt32(&ok);   
+  uint32_t index = propertyName.toArrayIndex(&ok);   
   if (ok) {   
     if (index >= length)   
       return true;

-- 
Configure bugmail: http://bugzilla.opendarwin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.