Bug 1287521 - Call ToUint32(limit) before ToString(separator) in String.prototype.split. r=till

This commit is contained in:
Tooru Fujisawa 2016-07-20 14:11:35 +09:00
parent 035175890b
commit 177afe670c
3 changed files with 30 additions and 4 deletions

View File

@ -295,13 +295,14 @@ function String_split(separator, limit) {
// Step 3.
var S = ToString(this);
// Step 9 (reordered).
var R = ToString(separator);
// Step 6.
var R;
if (limit !== undefined) {
var lim = limit >>> 0;
// Step 9.
R = ToString(separator);
// Step 10.
if (lim === 0)
return [];
@ -314,6 +315,9 @@ function String_split(separator, limit) {
return StringSplitStringLimit(S, R, lim);
}
// Step 9.
R = ToString(separator);
// Step 11.
if (separator === undefined)
return [S];

View File

@ -25,7 +25,7 @@ var o1 = { toString: function() { order += "b"; return "-"; }};
var o2 = { valueOf: function() { order += "a"; return 1; }};
var res = "xyz-xyz".split(o1, o2);
assertEq(order, "ba");
assertEq(order, "ab");
assertEqArr(res, ["xyz"]);
assertEqArr("".split(/.?/), []);

View File

@ -0,0 +1,22 @@
var BUGNUMBER = 1287521;
var summary = 'String.prototype.split should call ToUint32(limit) before ToString(separator).';
print(BUGNUMBER + ": " + summary);
var log = [];
"abba".split({
toString() {
log.push("separator-tostring");
return "b";
}
}, {
valueOf() {
log.push("limit-valueOf");
return 0;
}
});
assertEq(log.join(","), "limit-valueOf,separator-tostring");
if (typeof reportCompare === "function")
reportCompare(true, true);