Bug 80663 - Array.prototype.toLocaleString visits elements in wrong order under certain conditions
Summary: Array.prototype.toLocaleString visits elements in wrong order under certain c...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified All
: P2 Normal
Assignee: Gavin Barraclough
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-08 18:18 PST by André Bargull
Modified: 2012-03-09 17:20 PST (History)
2 users (show)

See Also:

Attachments
Fix (5.28 KB, patch)
2012-03-09 16:38 PST, Gavin Barraclough 		msaboff: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description André Bargull 2012-03-08 18:18:38 PST 
> [{toLocaleString:function(){throw 1}},{toLocaleString:function(){throw 2}}].toLocaleString()
Exception: 2

Per spec 15.4.4.3 [Array.prototype.toLocaleString()], array elements are visited in ascending order, but under certain conditions JSC violates the spec. In the example from above, the expected result is "Exception: 1" instead of "Exception: 2".
Comment 1 Gavin Barraclough 2012-03-09 16:00:24 PST 
The bug here is actually that we're continuing to process the array after an exception has been thrown, and that the second value throw is overriding the first.
Comment 2 Gavin Barraclough 2012-03-09 16:38:24 PST 
Created attachment 131135 [details]
Fix
Comment 3 Gavin Barraclough 2012-03-09 17:20:18 PST 
Fixed in r110352