Bug 80663

Summary: Array.prototype.toLocaleString visits elements in wrong order under certain conditions
Product: WebKit Reporter: André Bargull <andre.bargull>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: All   
Attachments:
Description Flags
Fix msaboff: review+

André Bargull
Reported 2012-03-08 18:18:38 PST
> [{toLocaleString:function(){throw 1}},{toLocaleString:function(){throw 2}}].toLocaleString() Exception: 2 Per spec 15.4.4.3 [Array.prototype.toLocaleString()], array elements are visited in ascending order, but under certain conditions JSC violates the spec. In the example from above, the expected result is "Exception: 1" instead of "Exception: 2".
Attachments
Fix (5.28 KB, patch)
2012-03-09 16:38 PST, Gavin Barraclough 		msaboff: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2012-03-09 16:00:24 PST
The bug here is actually that we're continuing to process the array after an exception has been thrown, and that the second value throw is overriding the first.
Gavin Barraclough
Comment 2 2012-03-09 16:38:24 PST
Created attachment 131135 [details] Fix
Gavin Barraclough
Comment 3 2012-03-09 17:20:18 PST
Fixed in r110352
Note You need to log in before you can comment on or make changes to this bug.