The length of array like objects can in some cases be 2^53 -1 in ES7

Add a Value::getLength(), that converts a Value to a length bound
between 0 and 2^53-1 as per ES7 spec. Use the extended range in
Array.prototype.splice and map to fix hanging test cases.

Change-Id: If9280d501423cfc10a60abd4e8aa30521d2a7bca
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 13 insertions, 0 deletions

diff --git a/src/qml/jsruntime/qv4value_p.h b/src/qml/jsruntime/qv4value_p.h
index 42c0370138..03c9eda0f2 100644
--- a/src/qml/jsruntime/qv4value_p.h
+++ b/src/qml/jsruntime/qv4value_p.h
@@ -389,6 +389,7 @@ public:
     int toUInt16() const;
     inline int toInt32() const;
     inline unsigned int toUInt32() const;
+    qint64 toLength() const;
 
     bool toBoolean() const {
         if (integerCompatible())
@@ -789,6 +790,18 @@ inline unsigned int Value::toUInt32() const
     return static_cast<unsigned int>(toInt32());
 }
 
+inline qint64 Value::toLength() const
+{
+    if (Q_LIKELY(integerCompatible()))
+        return int_32();
+    double i = Primitive::toInteger(isDouble() ? doubleValue() : toNumberImpl());
+    if (i <= 0)
+        return 0;
+    if (i > (static_cast<qint64>(1) << 53) - 1)
+        return (static_cast<qint64>(1) << 53) - 1;
+    return static_cast<qint64>(i);
+}
+
 inline double Value::toInteger() const
 {
     if (integerCompatible())