Status: New
Owner: ----
New issue 2263 by [email protected]: Array.prototype.join must perform
ToUint32(length) before ToString(separator)
http://code.google.com/p/v8/issues/detail?id=2263
Per spec, Array.prototype.join [15.4.4.5] performs ToUint32(length) before
ToString(separator), cf. step 2/3 and step 5.
var object = {length: {valueOf: function(){ throw "length" }}};
var sep = {toString: function(){ throw "toString" }};
try {
Array.prototype.join.call(object, sep);
print("ERROR - expected exception");
} catch (e) {
if (e !== "length") {
print("ERROR - expected 'length' but was: " + e);
} else {
print("SUCCESS");
}
}
Output is: `ERROR - expected 'length' but was: toString`
Output should be `SUCCESS`
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
