11529 2006-11-06 09:22:46 -0800 under js1.2, Array object should pop the last element as Number object's argument 2007-09-30 03:40:25 -0700 1 1 1 Unclassified WebKit JavaScriptCore 420+ Mac OS X 10.4 RESOLVED FIXED P2 Normal --- 0 digdog webkit-unassigned oldest_to_newest 46860 0 digdog 2006-11-06 09:22:46 -0800 Currently, the result will be correct if Number object uses Array object as argument, and the Array object has only one element. If array length is larger than one, the argument will become NaN. This is due to Array object will be first converted into ValueOf and later ToString, e.g. "element1, element2". The correct way based on js1.2 is to pop the last element if Array elements if more than one. Reference: /WebKit/JavaScriptCore/tests/mozilla/js1_2/function/Number.js Ln65 46861 1 11398 digdog 2006-11-06 09:26:17 -0800 Created attachment 11398 identifier.h 46862 2 11399 digdog 2006-11-06 09:26:54 -0800 Created attachment 11399 object.cpp 46863 3 digdog 2006-11-06 09:27:29 -0800 I try to fix it by added "pop" as Identifier's special prototype property name, and use it in *JSObject::defaultValue() 46864 4 digdog 2006-11-06 09:31:55 -0800 Should open for review. 46738 5 11408 digdog 2006-11-06 17:08:24 -0800 Created attachment 11408 Patch 46740 6 digdog 2006-11-06 17:24:05 -0800 However, this proposal seems conflict with ECMA-262v3 specs 9.3.1 & 8.6.2.6. Cause Object should call ToPrimitive first then ToNumber later after, and ToPrimitive was calling valueOf and toString. However, the Array prototype does not have valueOf, so it inherits the property from Object prototype. I am not sure if the valueOf [1,2,3] should be "1,2,3" or [object Array], and it will be "1,2,3" before this patch, and "3" after the patch applied. 46697 7 mjs 2006-11-06 20:43:05 -0800 If this change would result in violating the spec, I'd like to know: a) Do other major browsers (IE, Opera) also have this nonstandard behavior? b) Are there any sites that depend on the nonstandard behavior? 46645 8 digdog 2006-11-07 05:08:39 -0800 No and no. Mozilla SpiderMonkey (ES3) / Rinho (ES3), IE7 JScript.NET (ES4) and Opera (ES1) don't act like this, they all return NaN when array elements are greater than one. And since this is based on js1.2 and gone after that, I don't see any website using scripts in this way for a while. 46587 9 sam 2006-11-07 15:37:09 -0800 If none of the other browsers do this, no websites depend on the behavior and it violates the current specification, what is the rationale for making the change? If it's just to satisfy the test you mentioned, perhaps a better solution would be to change the test. 46591 10 11408 mjs 2006-11-07 21:15:53 -0800 Comment on attachment 11408 Patch Since this is against the spec and no other browsers do this, we should not make this change. It would be better to change or disable the test. Mozilla probably tests this because their JS interpreter has modes to request legacy behavior of old JS versions - we don't implement that and don't plan to. 46599 11 digdog 2006-11-08 02:21:52 -0800 I see. I will try to identify the failed testcases (of previous version, e.g. js1_2) that violate current spec, and see if we should close these tests. 57437 12 andrew 2007-09-30 03:40:25 -0700 This was fixed by r18071 fixing bug #11545 11398 2006-11-06 09:26:17 -0800 2006-11-06 17:07:01 -0800 identifier.h identifier.h.diff text/plain 703 digdog KioqIC90bXAvUEIuMjU0L1hDU0NNVG9wT2ZUcnVua1JldmlzaW9uLWlkZW50aWZpZXIuaC9pZGVu dGlmaWVyLmgJVHVlIE5vdiAgNyAwMDo1MjoyOCAyMDA2Ci0tLSBpZGVudGlmaWVyLmgJVHVlIE5v diAgNyAwMDozNzo0MSAyMDA2CioqKioqKioqKioqKioqKiBuYW1lc3BhY2UgS0pTIHsKKioqIDEx NCwxMjAgKioqKgogICAgICAgICAgbWFjcm8odG9GaXhlZCkgXAogICAgICAgICAgbWFjcm8odG9F eHBvbmVudGlhbCkgXAogICAgICAgICAgbWFjcm8odG9QcmVjaXNpb24pIFwKISAgICAgICAgIG1h Y3JvKHZhbHVlT2YpCiAgCiAgICAgIC8vIERlZmluZSBleHRlcm5hbCBnbG9iYWwgdmFyaWFibGVz IGZvciBhbGwgcHJvcGVydHkgbmFtZXMgYWJvdmUgKGFuZCBvbmUgbW9yZSkuCiAgI2lmbmRlZiBL SlNfSURFTlRJRklFUl9ISURFX0dMT0JBTFMKLS0tIDExNCwxMjEgLS0tLQogICAgICAgICAgbWFj cm8odG9GaXhlZCkgXAogICAgICAgICAgbWFjcm8odG9FeHBvbmVudGlhbCkgXAogICAgICAgICAg bWFjcm8odG9QcmVjaXNpb24pIFwKISAgICAgICAgIG1hY3JvKHZhbHVlT2YpIFwKISAJbWFjcm8o cG9wKQogIAogICAgICAvLyBEZWZpbmUgZXh0ZXJuYWwgZ2xvYmFsIHZhcmlhYmxlcyBmb3IgYWxs IHByb3BlcnR5IG5hbWVzIGFib3ZlIChhbmQgb25lIG1vcmUpLgogICNpZm5kZWYgS0pTX0lERU5U SUZJRVJfSElERV9HTE9CQUxTCg== 11399 2006-11-06 09:26:54 -0800 2006-11-06 17:07:23 -0800 object.cpp object.cpp.diff text/plain 863 digdog KioqIC90bXAvUEIuMjU0L1hDU0NNVG9wT2ZUcnVua1JldmlzaW9uLW9iamVjdC5jcHAvb2JqZWN0 LmNwcAlUdWUgTm92ICA3IDAwOjUxOjQzIDIwMDYKLS0tIG9iamVjdC5jcHAJVHVlIE5vdiAgNyAw MDo1MToyMSAyMDA2CioqKioqKioqKioqKioqKiBKU1ZhbHVlICpKU09iamVjdDo6ZGVmYXVsdFZh bHVlKEV4ZWNTdGF0CioqKiAzNDcsMzUyICoqKioKLS0tIDM0NywzNTYgLS0tLQogICAgaWYgKCho aW50ID09IFN0cmluZ1R5cGUpIHx8IChoaW50ICE9IFN0cmluZ1R5cGUpICYmIChoaW50ICE9IE51 bWJlclR5cGUpICYmIChfcHJvdG8gPT0gZXhlYy0+bGV4aWNhbEludGVycHJldGVyKCktPmJ1aWx0 aW5EYXRlUHJvdG90eXBlKCkpKSB7CiAgICAgIGZpcnN0UHJvcGVydHlOYW1lID0gdG9TdHJpbmdQ cm9wZXJ0eU5hbWU7CiAgICAgIHNlY29uZFByb3BlcnR5TmFtZSA9IHZhbHVlT2ZQcm9wZXJ0eU5h bWU7CisgICB9IGVsc2UgaWYgKChoaW50ID09IE51bWJlclR5cGUpICYmIChfcHJvdG8gPT0gZXhl Yy0+bGV4aWNhbEludGVycHJldGVyKCktPmJ1aWx0aW5BcnJheVByb3RvdHlwZSgpKSkgeworICAg ICAvKiBOZWVkIHRvIHBvcCB0aGUgbGFzdCBlbGVtZW50IHdoZW4gdGhlIEFycmF5IG9iamVjdCBp cyB0aGUgYXJndW1lbnQgb2YgTnVtYmVyIG9iamVjdCAqLworICAgICBmaXJzdFByb3BlcnR5TmFt ZSA9IHBvcFByb3BlcnR5TmFtZTsKKyAgICAgc2Vjb25kUHJvcGVydHlOYW1lID0gdG9TdHJpbmdQ cm9wZXJ0eU5hbWU7CiAgICB9IGVsc2UgewogICAgICBmaXJzdFByb3BlcnR5TmFtZSA9IHZhbHVl T2ZQcm9wZXJ0eU5hbWU7CiAgICAgIHNlY29uZFByb3BlcnR5TmFtZSA9IHRvU3RyaW5nUHJvcGVy dHlOYW1lOwo= 11408 2006-11-06 17:08:24 -0800 2006-11-07 21:15:53 -0800 Patch patch.txt text/plain 2035 digdog SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3NjIxKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMDYtMTEtMDcgIEtldmluIEZ5 dXJlICA8ZGlnZG9nQG1hY3BvcnRzLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICAqIGtqcy9pZGVudGlmaWVyLmg6CisgICAgICAgICoga2pzL29i amVjdC5jcHA6CisgICAgICAgIChLSlM6OkpTT2JqZWN0OjpkZWZhdWx0VmFsdWUpOgorCisgICAg ICAgIEJ1ZyAxMTUyOTogVW5kZXIganMxLjIsIEFycmF5IG9iamVjdCBzaG91bGQgcG9wIHRoZSBs YXN0IGVsZW1lbnQgYXMKKyAgICAgICAgYXJndW1lbnQgZm9yIE51bWJlciBvYmplY3QKKyAgICAg ICAgCiAyMDA2LTExLTA2ICBNYXJrIFJvd2UgIDxiZGFzaEB3ZWJraXQub3JnPgogCiAgICAgICAg IFJldmlld2VkIGJ5IHRoZSB3b25kZXJmdWwgTWl0eiBQZXR0ZWwuCkluZGV4OiBKYXZhU2NyaXB0 Q29yZS9ranMvaWRlbnRpZmllci5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEphdmFTY3JpcHRDb3JlL2tqcy9p ZGVudGlmaWVyLmgJKHJldmlzaW9uIDE3NjE0KQorKysgSmF2YVNjcmlwdENvcmUva2pzL2lkZW50 aWZpZXIuaAkod29ya2luZyBjb3B5KQpAQCAtMTE0LDcgKzExNCw4IEBAIG5hbWVzcGFjZSBLSlMg ewogICAgICAgICBtYWNybyh0b0ZpeGVkKSBcCiAgICAgICAgIG1hY3JvKHRvRXhwb25lbnRpYWwp IFwKICAgICAgICAgbWFjcm8odG9QcmVjaXNpb24pIFwKLSAgICAgICAgbWFjcm8odmFsdWVPZikK KyAgICAgICAgbWFjcm8odmFsdWVPZikgXAorCW1hY3JvKHBvcCkKIAogICAgIC8vIERlZmluZSBl eHRlcm5hbCBnbG9iYWwgdmFyaWFibGVzIGZvciBhbGwgcHJvcGVydHkgbmFtZXMgYWJvdmUgKGFu ZCBvbmUgbW9yZSkuCiAjaWZuZGVmIEtKU19JREVOVElGSUVSX0hJREVfR0xPQkFMUwpJbmRleDog SmF2YVNjcmlwdENvcmUva2pzL29iamVjdC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gSmF2YVNjcmlwdENv cmUva2pzL29iamVjdC5jcHAJKHJldmlzaW9uIDE3NjE0KQorKysgSmF2YVNjcmlwdENvcmUva2pz L29iamVjdC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTM0Nyw2ICszNDcsMTAgQEAgSlNWYWx1ZSAq SlNPYmplY3Q6OmRlZmF1bHRWYWx1ZShFeGVjU3RhdAogICBpZiAoKGhpbnQgPT0gU3RyaW5nVHlw ZSkgfHwgKGhpbnQgIT0gU3RyaW5nVHlwZSkgJiYgKGhpbnQgIT0gTnVtYmVyVHlwZSkgJiYgKF9w cm90byA9PSBleGVjLT5sZXhpY2FsSW50ZXJwcmV0ZXIoKS0+YnVpbHRpbkRhdGVQcm90b3R5cGUo KSkpIHsKICAgICBmaXJzdFByb3BlcnR5TmFtZSA9IHRvU3RyaW5nUHJvcGVydHlOYW1lOwogICAg IHNlY29uZFByb3BlcnR5TmFtZSA9IHZhbHVlT2ZQcm9wZXJ0eU5hbWU7CisgIH0gZWxzZSBpZiAo KGhpbnQgPT0gTnVtYmVyVHlwZSkgJiYgKF9wcm90byA9PSBleGVjLT5sZXhpY2FsSW50ZXJwcmV0 ZXIoKS0+YnVpbHRpbkFycmF5UHJvdG90eXBlKCkpKSB7CisgICAgLyogTmVlZCB0byBwb3AgdGhl IGxhc3QgZWxlbWVudCB3aGVuIHRoZSBBcnJheSBvYmplY3QgaXMgdGhlIGFyZ3VtZW50IG9mIE51 bWJlciBvYmplY3QgKi8KKyAgICBmaXJzdFByb3BlcnR5TmFtZSA9IHBvcFByb3BlcnR5TmFtZTsK KyAgICBzZWNvbmRQcm9wZXJ0eU5hbWUgPSB0b1N0cmluZ1Byb3BlcnR5TmFtZTsKICAgfSBlbHNl IHsKICAgICBmaXJzdFByb3BlcnR5TmFtZSA9IHZhbHVlT2ZQcm9wZXJ0eU5hbWU7CiAgICAgc2Vj b25kUHJvcGVydHlOYW1lID0gdG9TdHJpbmdQcm9wZXJ0eU5hbWU7Cg==