archives

« Bugzilla Issues Index

#1792 — Array splice, slice, indexOf, & lastIndexOf before other args are coerced.


Wanted to see if this was a spec bug.

var a = [1, 2, 3];
a.slice({ valueOf: function() { a.push(4,5,6); return 1; } });
// => [2, 3] in many implementations
// because ToUint32(lenVal) is performed before ToInteger(start).

var a = [1, 2, 3];
var b = a.slice({ valueOf: function() { a.shift(); return 1; } });
// => b is [3, undefined]
1 in b; // false because it's a hole

against a reasonable assumption that those params are evaluated before the slice and friends operation is actually performed.


For slice and splice, that's the way they were specified going back to ES3. Es5 andd indexof and lastIndexOf and followed the same pattern.

If modern IE (or others) is doing the more rational ordering and it isn't breaking things on the web then perhaps it could be changed in the ES6 spec.

You should bring this up on es-discuss and/or have Luke bring it to the the next TC39 meeting


Thanks, I was curious more than anything. I believe IE currently follows the spec'ed order of things. I'll pass this on to Luke.