| Summary: | negative array index is broken - difference when index is constant and variable | ||
|---|---|---|---|
| Product: | [Applications] konqueror | Reporter: | Michal Hlavinka <mhlavink> |
| Component: | kjs | Assignee: | Konqueror Developers <konq-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | ||
| Priority: | NOR | ||
| Version: | 4.3.0 | ||
| Target Milestone: | --- | ||
| Platform: | Fedora RPMs | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
| Attachments: | reproducer | ||
Created attachment 36208 [details]
reproducer
it's broken only for negative values, for positive values it works SVN commit 1215528 by orlovich: Fix problems with negative indeces in bracket ops in cases we can statically determine arguments to be of int32 type. Fixes reply problem on userbase.kde.org. I think I'll probably just have to bite the bullet and add in a uint32 type to FrostByte's type system, but getting conversion rules right for that will be tricky... and it'll be extra-annoying that all the bitops like to produce int32. BUG:262398 BUG:204143 M +23 -4 codes.def WebSVN link: http://websvn.kde.org/?view=rev&revision=1215528 SVN commit 1215529 by orlovich: Merged revision:r1215528 | orlovich | 2011-01-18 18:46:40 -0500 (Tue, 18 Jan 2011) | 11 lines Fix problems with negative indeces in bracket ops in cases we can statically determine arguments to be of int32 type. Fixes reply problem on userbase.kde.org. I think I'll probably just have to bite the bullet and add in a uint32 type to FrostByte's type system, but getting conversion rules right for that will be tricky... and it'll be extra-annoying that all the bitops like to produce int32. BUG:262398 BUG:204143 M +23 -4 codes.def WebSVN link: http://websvn.kde.org/?view=rev&revision=1215529 |
Version: 4.3.0 (using KDE 4.3.0) OS: Linux Installed from: Fedora RPMs for negative index, value returned differs when index is constant and when index is variable reproducer: <html><body> <script type="text/javascript"> var a=['hello','world']; document.write("a=['hello','world'];<br>\n"); a[-1]='XYZ'; b=-1; document.write("a[-1]='XYZ';<br>\n"); document.write("a[-1]=="+a[-1]+"<br>\n"); document.write("b=-1;<br>\na[b]=="+a[b]+"<br>\n"); </script> </body></html> actual result: a=['hello','world']; a[-1]='XYZ'; a[-1]==XYZ b=-1; a[b]==undefined expected result: a=['hello','world']; a[-1]='XYZ'; a[-1]==XYZ b=-1; a[b]==XYZ for b=-1 value of a[b] should be the same as for a[-1] in other browsers this works