[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.1.15-1-40151-g37bb677

[mjs]

The following commit has been merged in the debian/unstable branch:
commit f7b128b88b161af4253317404110711ef220e466
Author: mjs <mjs at 268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Fri Nov 21 08:54:42 2003 +0000

            Patch from Harri Porten, reviewed by me.
    
    	- fixed 3491712 - String slice with negative arguments does not offset from end of string
    
    	* kjs/string_object.cpp:
            (StringProtoFuncImp::call): Handle negative arguments as offsets from end by
    	adding length and clamping to [0,length-1].
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@5619 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 51cc9ea..9a091e6 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -2,6 +2,16 @@
 
         Patch from Harri Porten, reviewed by me.
 
+	- fixed 3491712 - String slice with negative arguments does not offset from end of string
+        
+	* kjs/string_object.cpp:
+        (StringProtoFuncImp::call): Handle negative arguments as offsets from end by
+	adding length and clamping to [0,length-1].
+
+2003-11-21  Maciej Stachowiak  <mjs at apple.com>
+
+        Patch from Harri Porten, reviewed by me.
+
 	- fixed 3491709 - using Function.apply with a primitive type as the arg list causes crash
         
 	* kjs/function_object.cpp:
diff --git a/JavaScriptCore/kjs/string_object.cpp b/JavaScriptCore/kjs/string_object.cpp
index eda5eb1..06535f7 100644
--- a/JavaScriptCore/kjs/string_object.cpp
+++ b/JavaScriptCore/kjs/string_object.cpp
@@ -377,20 +377,18 @@ Value StringProtoFuncImp::call(ExecState *exec, Object &thisObj, const List &arg
   case Slice: // http://developer.netscape.com/docs/manuals/js/client/jsref/string.htm#1194366
     {
         // The arg processing is very much like ArrayProtoFunc::Slice
-        // We return a new array
-        result = exec->interpreter()->builtinArray().construct(exec,List::empty());
         int begin = args[0].toUInt32(exec);
+        if (begin < 0)
+          begin = maxInt(begin + len, 0);
+        else
+          begin = minInt(begin, len);
         int end = len;
-        if (args[1].type() != UndefinedType)
-        {
-          end = args[1].toUInt32(exec);
-          if ( end < 0 )
-            end += len;
-        }
-        // safety tests
-        if ( begin < 0 || end < 0 || begin >= end ) {
-            result = String();
-            break;
+        if (args[1].type() != UndefinedType) {
+          end = args[1].toInteger(exec);
+          if (end < 0)
+            end = maxInt(len + end, 0);
+          else
+            end = minInt(end, len);
         }
         //printf( "Slicing from %d to %d \n", begin, end );
         result = String(s.substr(begin, end-begin));

-- 
WebKit Debian packaging