Bug 80663 - Array.prototype.toLocaleString visits elements in wrong order under certain conditions
Summary: Array.prototype.toLocaleString visits elements in wrong order under certain c...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified All
: P2 Normal
Assignee: Gavin Barraclough
Depends on:
Reported: 2012-03-08 18:18 PST by André Bargull
Modified: 2012-03-09 17:20 PST (History)
2 users (show)

See Also:

Fix (5.28 KB, patch)
2012-03-09 16:38 PST, Gavin Barraclough
msaboff: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description André Bargull 2012-03-08 18:18:38 PST
> [{toLocaleString:function(){throw 1}},{toLocaleString:function(){throw 2}}].toLocaleString()
Exception: 2

Per spec [Array.prototype.toLocaleString()], array elements are visited in ascending order, but under certain conditions JSC violates the spec. In the example from above, the expected result is "Exception: 1" instead of "Exception: 2".
Comment 1 Gavin Barraclough 2012-03-09 16:00:24 PST
The bug here is actually that we're continuing to process the array after an exception has been thrown, and that the second value throw is overriding the first.
Comment 2 Gavin Barraclough 2012-03-09 16:38:24 PST
Created attachment 131135 [details]
Comment 3 Gavin Barraclough 2012-03-09 17:20:18 PST
Fixed in r110352