From a9e0d95226f98817b822abe2d64894090f80f737 Mon Sep 17 00:00:00 2001 From: dotCooCoo Date: Sat, 7 Nov 2026 19:00:44 -0800 Subject: [PATCH] JavaScript: assigning an array's length converts the value twice, as defining it does Section 15.4.5.1 steps 3.c and 3.d convert the new length once with ToUint32 and once with ToNumber. [[Put]] reaches that algorithm through [[DefineOwnProperty]], so a.length = v now calls v's valueOf twice, the same as Object.defineProperty(a, 'length', {value: v}). Tests count the valueOf calls on both paths, check that JSON.stringify converts Number and String objects with ToNumber and ToString, and check that toLocaleString calls each primitive element's method on the object ToObject makes. --- crates/js/src/builtins_tests.rs | 14 ++++++++++++++ crates/js/src/interp.rs | 8 ++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/crates/js/src/builtins_tests.rs b/crates/js/src/builtins_tests.rs index ba54549999..3e8362e528 100644 --- a/crates/js/src/builtins_tests.rs +++ b/crates/js/src/builtins_tests.rs @@ -85,6 +85,10 @@ fn array_length_and_index_definitions_follow_section_15_4_5_1() { truth("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); a[5] = 1; a.length === 1 && !(5 in a)"); throws("var a = [1]; Object.defineProperty(a, 'length', {writable: false}); Object.defineProperty(a, '3', {value: 1});", "TypeError"); throws("Object.defineProperty([], 'length', {value: -1})", "RangeError"); + // Steps 3.c and 3.d convert the new length once with ToUint32 and once with ToNumber. + let counted = "var calls = 0; var len = {valueOf: function () { calls++; return 2; }}; var a = [1, 2, 3];"; + assert_eq!(num(&format!("{counted} Object.defineProperty(a, 'length', {{value: len}}); calls * 10 + a.length")), 22.0); + assert_eq!(num(&format!("{counted} a.length = len; calls * 10 + a.length")), 22.0); truth("var a = []; Object.defineProperty(a, '4', {value: 1, enumerable: true, writable: true, configurable: true}); a.length === 5"); throws("var a = Object.freeze([1, 2]); a.push(3);", "TypeError"); } @@ -229,6 +233,13 @@ fn join_and_to_string_are_cycle_safe() { assert_eq!(string("[null, undefined, 0].join('-')"), "--0"); assert_eq!(string("Array.prototype.toString.call({join: 1})"), "[object Object]"); assert_eq!(string("var a = [{toLocaleString: function () { return 'L'; }}, null]; a.push(a); a.toLocaleString()"), "L,,"); + // A primitive element is converted with ToObject and its toLocaleString is called on the object. + assert_eq!( + string( + "Object.getPrototypeOf(Object(1)).toLocaleString = function () { 'use strict'; return typeof this; }; [1, undefined, 2].toLocaleString()" + ), + "object,,object" + ); } #[test] @@ -501,6 +512,9 @@ fn json_stringify_writes_values_with_replacers_and_indentation() { assert_eq!(string("JSON.stringify({toJSON: function (k) { return 'k=' + k; }})"), "\"k=\""); assert_eq!(string("JSON.stringify({d: {toJSON: function (k) { return k; }}})"), "{\"d\":\"d\"}"); assert_eq!(string("JSON.stringify([Object(false), Object(true)])"), "[false,true]"); + // Number and String objects go through ToNumber and ToString, which call valueOf and toString. + assert_eq!(string("var n = Object(5); n.valueOf = function () { return 7; }; JSON.stringify([n])"), "[7]"); + assert_eq!(string("var s = Object('x'); s.toString = function () { return 'y'; }; JSON.stringify({s: s})"), "{\"s\":\"y\"}"); assert_eq!(string("JSON.stringify({}, null, 4) + JSON.stringify([], null, 4)"), "{}[]"); throws("var a = []; a.push(a); JSON.stringify(a)", "TypeError"); throws("var o = {}; o.x = {y: o}; JSON.stringify(o)", "TypeError"); diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs index 1a60bc8a60..5133b597f2 100644 --- a/crates/js/src/interp.rs +++ b/crates/js/src/interp.rs @@ -1272,11 +1272,11 @@ impl Interp { } } - /// Assigning to an array's `length` (section 15.4.5.1). + /// Assigning to an array's `length` (section 15.4.5.1). [[Put]] defines the value, so the + /// value is converted once with ToUint32 and once with ToNumber, as in steps 3.c and 3.d. fn set_array_length(&mut self, id: ObjId, v: &Value, throw: bool) -> JsResult<()> { - let n = self.to_number(v)?; - let new = to_uint32(n); - if f64::from(new) != n { + let new = to_uint32(self.to_number(v)?); + if f64::from(new) != self.to_number(v)? { return Err(self.throw(ErrorType::Range, "invalid array length")); } let Class::Array { length_writable, .. } = self.object(id)?.class else { return internal("not an array") };