Status: New
Owner: ----
New issue 1050 by [email protected]:
Array.prototype.slice.call(arguments) can results in incorrect array length
http://code.google.com/p/v8/issues/detail?id=1050
Within a function, if any value is assigned to a variable defined as a
parameter, arguments.length will be interpreted incorrectly when using
Array.prototype.slice to convert the arguments to an actual array.
The following examples show the problem:
(function(a) { a = 0; return [].slice.call(arguments).length; }()) //=> 17
(function(a,b) { b = 0; return [].slice.call(arguments).length; }()) //=> 19
(function(a,b,c) { c = 0; return [].slice.call(arguments).length; }()) //=>
20
The numbers continue to grow as you add more parameters, but the value is
based on whichever parameter is reassigned first.
(function(a,b,c) { a = 0; c = 0; return [].slice.call(arguments).length;
}()) //=> 17
(function(a,b,c) { c = 0; a = 0; return [].slice.call(arguments).length;
}()) //=> 20
Tested in 3.0.6.1 and 3.0.7.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
