| Summary: | Array.prototype.toLocaleString visits elements in wrong order under certain conditions | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | André Bargull <andre.bargull> | ||||
| Component: | JavaScriptCore | Assignee: | Gavin Barraclough <barraclough> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | barraclough, oliver | ||||
| Priority: | P2 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | All | ||||||
| Attachments: |
|
||||||
The bug here is actually that we're continuing to process the array after an exception has been thrown, and that the second value throw is overriding the first. Created attachment 131135 [details]
Fix
|
> [{toLocaleString:function(){throw 1}},{toLocaleString:function(){throw 2}}].toLocaleString() Exception: 2 Per spec 15.4.4.3 [Array.prototype.toLocaleString()], array elements are visited in ascending order, but under certain conditions JSC violates the spec. In the example from above, the expected result is "Exception: 1" instead of "Exception: 2".