Backed out changeset 9345403c7628 (bug 1171036)
authorCarsten "Tomcat" Book <cbook@mozilla.com>
Wed, 17 Jun 2015 11:02:46 +0200
changeset 249319 a74edde76e5dd559568b045fed1348c5748b4384
parent 249318 daefa5ea5f981ca4a0026be825c9eda09d815f90
child 249320 ed587a5aaecf2afd6313a1c6aa230210811e7603
push id28923
push userryanvm@gmail.com
push dateWed, 17 Jun 2015 18:57:11 +0000
treeherdermozilla-central@099d6cd6725e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1171036
milestone41.0a1
backs out9345403c76288e468409cc12411f8ce16ed1a630
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 9345403c7628 (bug 1171036)
js/src/jsarray.cpp
js/src/tests/ecma_5/Array/unshift-01.js
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -78,23 +78,22 @@ js::GetLengthProperty(JSContext* cx, Han
             return true;
         }
     }
 
     RootedValue value(cx);
     if (!GetProperty(cx, obj, obj, cx->names().length, &value))
         return false;
 
-    bool overflow;
-    if (!ToLengthClamped(cx, value, lengthp, &overflow)) {
-        if (!overflow)
-            return false;
-        *lengthp = UINT32_MAX;
+    if (value.isInt32()) {
+        *lengthp = uint32_t(value.toInt32()); // uint32_t cast does ToUint32
+        return true;
     }
-    return true;
+
+    return ToUint32(cx, value, lengthp);
 }
 
 /*
  * Determine if the id represents an array index.
  *
  * An id is an array index according to ECMA by (15.4):
  *
  * "Array objects give special treatment to a certain class of property names.
--- a/js/src/tests/ecma_5/Array/unshift-01.js
+++ b/js/src/tests/ecma_5/Array/unshift-01.js
@@ -8,38 +8,34 @@ var BUGNUMBER = 614070;
 var summary = 'Array.prototype.unshift without args';
 
 print(BUGNUMBER + ": " + summary);
 
 /**************
  * BEGIN TEST *
  **************/
 
-// ES6 ToLength clamps length values to 2^53 - 1.
-// We currently clamp to 2^32 - 1 instead. See bug 924058.
-var MAX_LENGTH = 0xffffffff;
-
 var a = {};
-a.length = MAX_LENGTH + 1;
-assertEq([].unshift.call(a), MAX_LENGTH);
-assertEq(a.length, MAX_LENGTH);
+a.length = 4294967296;
+assertEq([].unshift.call(a), 0);
+assertEq(a.length, 0);
 
 function testGetSet(len, expected) {
     var newlen;
     var a = { get length() { return len; }, set length(v) { newlen = v; } };
     var res = [].unshift.call(a);
     assertEq(res, expected);
     assertEq(newlen, expected);
 }
 
 testGetSet(0, 0);
 testGetSet(10, 10);
 testGetSet("1", 1);
 testGetSet(null, 0);
-testGetSet(MAX_LENGTH + 2, MAX_LENGTH);
-testGetSet(-5, 0);
+testGetSet(4294967297, 1);
+testGetSet(-5, 4294967291);
 
 /******************************************************************************/
 
 if (typeof reportCompare === "function")
   reportCompare(true, true);
 
 print("All tests passed!");