User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 According to ECMA 262, section 15.4 it should be possible to access array elements equivalently with a number or a string representation of the same number as long as the number is between >>> var arr = [] >>> arr[17] = 'seventeen' "seventeen" >>> arr['17'] "seventeen" This fails for -2^30 = -1073741824 >>> arr[-1073741824] = 'minus 2^30' "minus 2^30" >>> arr['-1073741824'] (no result) Reproducible: Always Steps to Reproduce: 1. Open the firebug console 2. Enter: var x = []; x[-1073741824] = 'aa' 3. Enter: x['-1073741824'].length Actual Results: Get message: TypeError: arr['-1073741824'] is undefined { message="arr['-1073741824'] is undefined", more...} Expected Results: Should get the value 2 for the length of the string 'aa' I've run a loop on all integer multiples of 1024 and all values besides -1073741824 work fine.

(In reply to comment #0) Ignore the text "as long as the number is between"

I'll take a look at this "shortly". I'm guessing it's an off-by-one error in js_CheckForStringIndex or whatever it's named.

This is a regression from the bug 432881.

Lots of interesting history-diving done researching this, didn't know (remember?) integral jsids were once constrained to the symmetric range [-1073741823, 1073741823]. Too bad bug 57043's tests didn't check obvious integer-range fenceposts (I don't consider -0 obvious, but had the test at the time included it it would have tested -- and revealed -- yet another bug in the check-for-string-index algorithm), else it would have prevented this bug's introduction.

Comment on attachment 480013 [details] [diff] [review] Patch, update existing test which *should* have revealed this bug if it had tested fenceposts Bouncing, I flunked review last time on Igor's patch and he wrote that patch, so he's _heir apparent_. FWIW this looks correct to me, and the test vector is now righteous. /be