Reviewers: Dan Ehrenberg,
Description:
Fix limit calculation in String.prototype.split
We are supposed to calculate the limit by using 2^53-1 if it
is undefined, and ToLength otherwise. Instead, we were using
32-bit unsigned integer values, which don't make sense and
were breaking a test.
[email protected]
LOG=N
BUG=v8:4245
Please review this at https://codereview.chromium.org/1226143009/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+3, -1 lines):
M src/string.js
Index: src/string.js
diff --git a/src/string.js b/src/string.js
index
3ddd6d26cedfd9e49a5e624e071f0caeb005fba7..9a19258dd69388318e3e2686b8ed3b305277f6dd
100644
--- a/src/string.js
+++ b/src/string.js
@@ -10,6 +10,7 @@
// Imports
var GlobalRegExp = global.RegExp;
+var GlobalNumber = global.Number;
var GlobalString = global.String;
var InternalArray = utils.InternalArray;
var InternalPackedArray = utils.InternalPackedArray;
@@ -608,7 +609,8 @@ function StringSplitJS(separator, limit) {
CHECK_OBJECT_COERCIBLE(this, "String.prototype.split");
var subject = TO_STRING_INLINE(this);
- limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
+ limit = IS_UNDEFINED(limit) ? GlobalNumber.MAX_SAFE_INTEGER
+ : $toLength(limit);
var length = subject.length;
if (!IS_REGEXP(separator)) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
