ES6: Array.prototype.slice and friends should use ToLength instead of ToUint32

src/array.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
 var Delete;
 var GlobalArray = global.Array;
 var InternalArray = utils.InternalArray;
 var InternalPackedArray = utils.InternalPackedArray;
 var MathMin;
 var ObjectHasOwnProperty;
 var ObjectIsFrozen;
 var ObjectIsSealed;
 var ObjectToString;
 var ToNumber;
 var ToString;
+var ToLengthFlagged;
 
 utils.Import(function(from) {
   Delete = from.Delete;
   MathMin = from.MathMin;
   ObjectHasOwnProperty = from.ObjectHasOwnProperty;
   ObjectIsFrozen = from.ObjectIsFrozen;
   ObjectIsSealed = from.ObjectIsSealed;
   ObjectToString = from.ObjectToString;
   ToNumber = from.ToNumber;
   ToString = from.ToString;
+  ToLengthFlagged = from.ToLengthFlagged;
 });
 
 // -------------------------------------------------------------------
 
 // Global list of arrays visited during toString, toLocaleString and
 // join invocations.
 var visited_arrays = new InternalArray();
 
 
 // Gets a sorted array of array keys.  Useful for operations on sparse
@@ skipping 342 matching lines @@
     func = array.join;
   }
   if (!IS_SPEC_FUNCTION(func)) {
     return %_CallFunction(array, ObjectToString);
   }
   return %_CallFunction(array, func);
 }
 
 
 function InnerArrayToLocaleString(array, length) {
-  var len = TO_UINT32(length);
+  var len = ToLengthFlagged(length);
   if (len === 0) return "";
   return Join(array, len, ',', ConvertToLocaleString);
 }
 
 
 function ArrayToLocaleString() {
   var array = TO_OBJECT(this);
   var arrayLen = array.length;
   return InnerArrayToLocaleString(array, arrayLen);
 }
@@ skipping 18 matching lines @@
   }
 
   return Join(array, length, separator, ConvertToString);
 }
 
 
 function ArrayJoin(separator) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.join");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
 
   return InnerArrayJoin(separator, array, length);
 }
 
 
 function ObservedArrayPop(n) {
   n--;
   var value = this[n];
 
   try {
     $observeBeginPerformSplice(this);
     delete this[n];
     this.length = n;
   } finally {
     $observeEndPerformSplice(this);
     $observeEnqueueSpliceRecord(this, n, [value], 0);
   }
 
   return value;
 }
 
 
 // Removes the last element from the array and returns it. See
 // ECMA-262, section 15.4.4.6.
 function ArrayPop() {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.pop");
 
   var array = TO_OBJECT(this);
-  var n = TO_UINT32(array.length);
+  var n = ToLengthFlagged(array.length);
   if (n == 0) {
     array.length = n;
     return;
   }
 
   if (%IsObserved(array))
     return ObservedArrayPop.call(array, n);
 
   n--;
   var value = array[n];
   Delete(array, n, true);
   array.length = n;
   return value;
 }
 
 
 function ObservedArrayPush() {
-  var n = TO_UINT32(this.length);
+  var n = ToLengthFlagged(this.length);
   var m = %_ArgumentsLength();
 
   try {
     $observeBeginPerformSplice(this);
     for (var i = 0; i < m; i++) {
       this[i+n] = %_Arguments(i);
     }
     var new_length = n + m;
     this.length = new_length;
   } finally {
     $observeEndPerformSplice(this);
     $observeEnqueueSpliceRecord(this, n, [], m);
   }
 
   return new_length;
 }
 
 
 // Appends the arguments to the end of the array and returns the new
 // length of the array. See ECMA-262, section 15.4.4.7.
 function ArrayPush() {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.push");
 
   if (%IsObserved(this))
     return ObservedArrayPush.apply(this, arguments);
 
   var array = TO_OBJECT(this);
-  var n = TO_UINT32(array.length);
+  var n = ToLengthFlagged(array.length);
   var m = %_ArgumentsLength();
 
   for (var i = 0; i < m; i++) {
     array[i+n] = %_Arguments(i);
   }
 
   var new_length = n + m;
   array.length = new_length;
   return new_length;
 }
@@ skipping 94 matching lines @@
     }
   }
   return array;
 }
 
 
 function ArrayReverse() {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.reverse");
 
   var array = TO_OBJECT(this);
-  var len = TO_UINT32(array.length);
+  var len = ToLengthFlagged(array.length);
   var isArray = IS_ARRAY(array);
 
   if (UseSparseVariant(array, len, isArray, len)) {
     %NormalizeElements(array);
     SparseReverse(array, len);
     return array;
   } else if (isArray && %_HasFastPackedElements(array)) {
     return PackedArrayReverse(array, len);
   } else {
     return GenericArrayReverse(array, len);
@@ skipping 14 matching lines @@
   }
 
   return first;
 }
 
 
 function ArrayShift() {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.shift");
 
   var array = TO_OBJECT(this);
-  var len = TO_UINT32(array.length);
+  var len = ToLengthFlagged(array.length);
 
   if (len === 0) {
     array.length = 0;
     return;
   }
 
   if (ObjectIsSealed(array)) throw MakeTypeError(kArrayFunctionsOnSealed);
 
   if (%IsObserved(array))
     return ObservedArrayShift.call(array, len);
 
   var first = array[0];
 
   if (UseSparseVariant(array, len, IS_ARRAY(array), len)) {
     SparseMove(array, 0, 1, len, 0);
   } else {
     SimpleMove(array, 0, 1, len, 0);
   }
 
   array.length = len - 1;
 
   return first;
 }
 
 
 function ObservedArrayUnshift() {
-  var len = TO_UINT32(this.length);
+  var len = ToLengthFlagged(this.length);
   var num_arguments = %_ArgumentsLength();
 
   try {
     $observeBeginPerformSplice(this);
     SimpleMove(this, 0, 0, len, num_arguments);
     for (var i = 0; i < num_arguments; i++) {
       this[i] = %_Arguments(i);
     }
     var new_length = len + num_arguments;
     this.length = new_length;
   } finally {
     $observeEndPerformSplice(this);
     $observeEnqueueSpliceRecord(this, 0, [], num_arguments);
   }
 
   return new_length;
 }
 
 
 function ArrayUnshift(arg1) {  // length == 1
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.unshift");
 
   if (%IsObserved(this))
     return ObservedArrayUnshift.apply(this, arguments);
 
   var array = TO_OBJECT(this);
-  var len = TO_UINT32(array.length);
+  var len = ToLengthFlagged(array.length);
   var num_arguments = %_ArgumentsLength();
 
   if (len > 0 && UseSparseVariant(array, len, IS_ARRAY(array), len) &&
       !ObjectIsSealed(array)) {
     SparseMove(array, 0, 0, len, num_arguments);
   } else {
     SimpleMove(array, 0, 0, len, num_arguments);
   }
 
   for (var i = 0; i < num_arguments; i++) {
     array[i] = %_Arguments(i);
   }
 
   var new_length = len + num_arguments;
   array.length = new_length;
   return new_length;
 }
 
 
 function ArraySlice(start, end) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.slice");
 
   var array = TO_OBJECT(this);
-  var len = TO_UINT32(array.length);
+  var len = ToLengthFlagged(array.length);
   var start_i = TO_INTEGER(start);
   var end_i = len;
 
   if (!IS_UNDEFINED(end)) end_i = TO_INTEGER(end);
 
   if (start_i < 0) {
     start_i += len;
     if (start_i < 0) start_i = 0;
   } else {
     if (start_i > len) start_i = len;
@@ skipping 50 matching lines @@
 
   if (del_count > len - start_i)
     return len - start_i;
 
   return del_count;
 }
 
 
 function ObservedArraySplice(start, delete_count) {
   var num_arguments = %_ArgumentsLength();
-  var len = TO_UINT32(this.length);
+  var len = ToLengthFlagged(this.length);
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
   var deleted_elements = [];
   deleted_elements.length = del_count;
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
   try {
     $observeBeginPerformSplice(this);
 
@@ skipping 26 matching lines @@
 
 
 function ArraySplice(start, delete_count) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.splice");
 
   if (%IsObserved(this))
     return ObservedArraySplice.apply(this, arguments);
 
   var num_arguments = %_ArgumentsLength();
   var array = TO_OBJECT(this);
-  var len = TO_UINT32(array.length);
+  var len = ToLengthFlagged(array.length);
   var start_i = ComputeSpliceStartIndex(TO_INTEGER(start), len);
   var del_count = ComputeSpliceDeleteCount(delete_count, num_arguments, len,
                                            start_i);
   var deleted_elements = [];
   deleted_elements.length = del_count;
   var num_elements_to_add = num_arguments > 2 ? num_arguments - 2 : 0;
 
   if (del_count != num_elements_to_add && ObjectIsSealed(array)) {
     throw MakeTypeError(kArrayFunctionsOnSealed);
   } else if (del_count > 0 && ObjectIsFrozen(array)) {
@@ skipping 311 matching lines @@
   }
 
   return this;
 }
 
 
 function ArraySort(comparefn) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.sort");
 
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   return %_CallFunction(array, length, comparefn, InnerArraySort);
 }
 
 
 // The following functions cannot be made efficient on sparse arrays while
 // preserving the semantics, since the calls to the receiver function can add
 // or delete elements from the array.
 function InnerArrayFilter(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
@@ skipping 20 matching lines @@
   }
   return accumulator;
 }
 
 function ArrayFilter(f, receiver) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.filter");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   var accumulator = InnerArrayFilter(f, receiver, array, length);
   var result = new GlobalArray();
   %MoveArrayContents(accumulator, result);
   return result;
 }
 
 function InnerArrayForEach(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
   if (IS_NULL(receiver)) {
@@ skipping 14 matching lines @@
     }
   }
 }
 
 function ArrayForEach(f, receiver) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.forEach");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   InnerArrayForEach(f, receiver, array, length);
 }
 
 
 function InnerArraySome(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
   if (IS_NULL(receiver)) {
     if (%IsSloppyModeFunction(f)) receiver = UNDEFINED;
   } else if (!IS_UNDEFINED(receiver)) {
@@ skipping 16 matching lines @@
 
 
 // Executes the function once for each element present in the
 // array until it finds one where callback returns true.
 function ArraySome(f, receiver) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.some");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   return InnerArraySome(f, receiver, array, length);
 }
 
 
 function InnerArrayEvery(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
   if (IS_NULL(receiver)) {
     if (%IsSloppyModeFunction(f)) receiver = UNDEFINED;
   } else if (!IS_UNDEFINED(receiver)) {
@@ skipping 13 matching lines @@
   }
   return true;
 }
 
 function ArrayEvery(f, receiver) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.every");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   return InnerArrayEvery(f, receiver, array, length);
 }
 
 
 function InnerArrayMap(f, receiver, array, length) {
   if (!IS_SPEC_FUNCTION(f)) throw MakeTypeError(kCalledNonCallable, f);
   var needs_wrapper = false;
   if (IS_NULL(receiver)) {
     if (%IsSloppyModeFunction(f)) receiver = UNDEFINED;
   } else if (!IS_UNDEFINED(receiver)) {
@@ skipping 15 matching lines @@
   return accumulator;
 }
 
 
 function ArrayMap(f, receiver) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.map");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   var accumulator = InnerArrayMap(f, receiver, array, length);
   var result = new GlobalArray();
   %MoveArrayContents(accumulator, result);
   return result;
 }
 
 
 // For .indexOf, we don't need to pass in the number of arguments
 // at the callsite since ToInteger(undefined) == 0; however, for
 // .lastIndexOf, we need to pass it, since the behavior for passing
@@ skipping 48 matching lines @@
       return i;
     }
   }
   return -1;
 }
 
 
 function ArrayIndexOf(element, index) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.indexOf");
 
-  var length = TO_UINT32(this.length);
+  var length = ToLengthFlagged(this.length);
   return %_CallFunction(this, element, index, length, InnerArrayIndexOf);
 }
 
 
 function InnerArrayLastIndexOf(element, index, length, argumentsLength) {
   if (length == 0) return -1;
   if (argumentsLength < 2) {
     index = length - 1;
   } else {
     index = TO_INTEGER(index);
@@ skipping 37 matching lines @@
       return i;
     }
   }
   return -1;
 }
 
 
 function ArrayLastIndexOf(element, index) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.lastIndexOf");
 
-  var length = TO_UINT32(this.length);
+  var length = ToLengthFlagged(this.length);
   return %_CallFunction(this, element, index, length,
                         %_ArgumentsLength(), InnerArrayLastIndexOf);
 }
 
 
 function InnerArrayReduce(callback, current, array, length, argumentsLength) {
   if (!IS_SPEC_FUNCTION(callback)) {
     throw MakeTypeError(kCalledNonCallable, callback);
   }
 
@@ skipping 21 matching lines @@
   return current;
 }
 
 
 function ArrayReduce(callback, current) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.reduce");
 
   // Pull out the length so that modifications to the length in the
   // loop will not affect the looping and side effects are visible.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   return InnerArrayReduce(callback, current, array, length,
                           %_ArgumentsLength());
 }
 
 
 function InnerArrayReduceRight(callback, current, array, length,
                                argumentsLength) {
   if (!IS_SPEC_FUNCTION(callback)) {
     throw MakeTypeError(kCalledNonCallable, callback);
   }
@@ skipping 22 matching lines @@
   return current;
 }
 
 
 function ArrayReduceRight(callback, current) {
   CHECK_OBJECT_COERCIBLE(this, "Array.prototype.reduceRight");
 
   // Pull out the length so that side effects are visible before the
   // callback function is checked.
   var array = TO_OBJECT(this);
-  var length = TO_UINT32(array.length);
+  var length = ToLengthFlagged(array.length);
   return InnerArrayReduceRight(callback, current, array, length,
                                %_ArgumentsLength());
 }
 
 // ES5, 15.4.3.2
 function ArrayIsArray(obj) {
   return IS_ARRAY(obj);
 }
 
 
@@ skipping 113 matching lines @@
   "array_concat", ArrayConcatJS,
   "array_pop", ArrayPop,
   "array_push", ArrayPush,
   "array_shift", ArrayShift,
   "array_splice", ArraySplice,
   "array_slice", ArraySlice,
   "array_unshift", ArrayUnshift,
 ]);
 
 });