See the following testcase: var a = new Array(); a[1] = 4; a['1.0'] = 5; delete a['1.0']; alert(a[1]); here, the alert at the end should IMHO return 4 (which FFox, WinIE, and Konq 3.5 all do), and not Undefined as JSC seems to produce, as the property 1.0 being removed is not an array index (toString(toUint32('1.0')) != '1.0) I believe the following is the fix: --- array_object.cpp (revision 489699) +++ array_object.cpp (working copy) @@ -160,7 +160,7 @@ bool ArrayInstanceImp::deleteProperty(Ex return false; bool ok; - uint32_t index = propertyName.toUInt32(&ok); + uint32_t index = propertyName.toArrayIndex(&ok); if (ok) { if (index >= length) return true;
Created attachment 5297 [details] Maks's fix in patch form, with test case
Comment on attachment 5297 [details] Maks's fix in patch form, with test case r=me on Mak's fix