Reviewers: Mads Ager,
Description:
Convert this.length to uint32 in Array.prototype.[last]indexOf.
Please review this at http://codereview.chromium.org/3104033/show
Affected files:
M src/array.js
Index: src/array.js
diff --git a/src/array.js b/src/array.js
index
f3c0697b994b36f50f4a6c966816d3359ef9375b..dfa73011d0bc682e2530b0d7e401997ecbea7ab4
100644
--- a/src/array.js
+++ b/src/array.js
@@ -953,7 +953,8 @@ function ArrayMap(f, receiver) {
function ArrayIndexOf(element, index) {
- var length = this.length;
+ var length = TO_UINT32(this.length);
+ if (length == 0) return -1;
if (IS_UNDEFINED(index)) {
index = 0;
} else {
@@ -963,13 +964,13 @@ function ArrayIndexOf(element, index) {
// If index is still negative, search the entire array.
if (index < 0) index = 0;
}
+ // Lookup through the array.
if (!IS_UNDEFINED(element)) {
for (var i = index; i < length; i++) {
if (this[i] === element) return i;
}
return -1;
}
- // Lookup through the array.
for (var i = index; i < length; i++) {
if (IS_UNDEFINED(this[i]) && i in this) {
return i;
@@ -980,7 +981,8 @@ function ArrayIndexOf(element, index) {
function ArrayLastIndexOf(element, index) {
- var length = this.length;
+ var length = TO_UINT32(this.length);
+ if (length == 0) return -1;
if (%_ArgumentsLength() < 2) {
index = length - 1;
} else {
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
