Bug 6234 – Can delete array index property incorrectly.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Maks Orlovich]

See the following testcase:  
var a = new Array();  
a[1]     = 4;  
a['1.0'] = 5;  
delete a['1.0'];  
alert(a[1]);  
  
here, the alert at the end should IMHO return 4 (which FFox, WinIE, and Konq 
3.5 all do), and not Undefined as JSC seems to produce, as the property 1.0 
being  removed is not an array index (toString(toUint32('1.0')) != '1.0)  
  
I believe the following is the fix: 
--- array_object.cpp    (revision 489699)   
+++ array_object.cpp    (working copy)   
@@ -160,7 +160,7 @@ bool ArrayInstanceImp::deleteProperty(Ex   
     return false;   
   
   bool ok;   
-  uint32_t index = propertyName.toUInt32(&ok);   
+  uint32_t index = propertyName.toArrayIndex(&ok);   
   if (ok) {   
     if (index >= length)   
       return true;

[Maciej Stachowiak]

Created attachment 5297 [details]
Maks's fix in patch form, with test case

[Maciej Stachowiak]

Comment on attachment 5297 [details]
Maks's fix in patch form, with test case

r=me on Mak's fix