Fixed bug in array filter and reduce functions.

src/array.js

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 981 matching lines @@
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["Array.prototype.filter"]);
   }
 
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping.
-  var length = this.length;
+  var length = ToUint32(this.length);
   var result = [];
   var result_length = 0;
   for (var i = 0; i < length; i++) {
     var current = this[i];
     if (!IS_UNDEFINED(current) || i in this) {
       if (f.call(receiver, current, i, this)) {
         result[result_length++] = current;
       }
     }
   }
@@ skipping 216 matching lines @@
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["Array.prototype.reduce"]);
   }
 
   if (!IS_FUNCTION(callback)) {
     throw MakeTypeError('called_non_callable', [callback]);
   }
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping.
-  var length = this.length;
+  var length = ToUint32(this.length);
   var i = 0;
 
   find_initial: if (%_ArgumentsLength() < 2) {
     for (; i < length; i++) {
       current = this[i];
       if (!IS_UNDEFINED(current) || i in this) {
         i++;
         break find_initial;
       }
     }
@@ skipping 11 matching lines @@
 
 function ArrayReduceRight(callback, current) {
   if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
     throw MakeTypeError("called_on_null_or_undefined",
                         ["Array.prototype.reduceRight"]);
   }
 
   if (!IS_FUNCTION(callback)) {
     throw MakeTypeError('called_non_callable', [callback]);
   }
-  var i = this.length - 1;
+  var i = ToUint32(this.length) - 1;
 
   find_initial: if (%_ArgumentsLength() < 2) {
     for (; i >= 0; i--) {
       current = this[i];
       if (!IS_UNDEFINED(current) || i in this) {
         i--;
         break find_initial;
       }
     }
     throw MakeTypeError('reduce_no_initial', []);
@@ skipping 78 matching lines @@
   InternalArray.prototype.join = getFunction("join", ArrayJoin);
   InternalArray.prototype.pop = getFunction("pop", ArrayPop);
   InternalArray.prototype.push = getFunction("push", ArrayPush);
   InternalArray.prototype.toString = function() {
     return "Internal Array, length " + this.length;
   };
 }
 
 
 SetupArray();