Array.slice() fix

[Harri Porten]

Hi,

this patch fixes Array.slice(start, end) to properly handle calls where
end is less or equal to start. Resulted in an infinite loop previously.
Added testcase to khtmltests/js/Array.js.

Harri.
-------------- next part --------------
Index: array_object.cpp
===================================================================
RCS file: /home/kde/kdelibs/kjs/array_object.cpp,v
retrieving revision 1.56
diff -u -3 -p -r1.56 array_object.cpp
--- array_object.cpp	10 Nov 2003 23:20:00 -0000	1.56
+++ array_object.cpp	16 Nov 2003 20:30:04 -0000
@@ -607,7 +607,7 @@ Value ArrayProtoFuncImp::call(ExecState 
     // We return a new array
     Object resObj = Object::dynamicCast(exec->interpreter()->builtinArray().construct(exec,List::empty()));
     result = resObj;
-    int begin = args[0].toUInt32(exec);
+    int begin = args[0].toInteger(exec);
     if ( begin < 0 )
       begin = maxInt( begin + length, 0 );
     else
@@ -615,7 +615,7 @@ Value ArrayProtoFuncImp::call(ExecState 
     int end = length;
     if (args[1].type() != UndefinedType)
     {
-      end = args[1].toUInt32(exec);
+      end = args[1].toInteger(exec);
       if ( end < 0 )
         end = maxInt( end + length, 0 );
       else
@@ -623,13 +623,14 @@ Value ArrayProtoFuncImp::call(ExecState 
     }
 
     //printf( "Slicing from %d to %d \n", begin, end );
-    for(unsigned int k = 0; k < (unsigned int) end-begin; k++) {
-      if (thisObj.hasProperty(exec,k+begin)) {
-        Value obj = thisObj.get(exec, k+begin);
-        resObj.put(exec, k, obj);
+    int n = 0;
+    for(int k = begin; k < end; k++, n++) {
+      if (thisObj.hasProperty(exec, k)) {
+        Value obj = thisObj.get(exec, k);
+        resObj.put(exec, n, obj);
       }
     }
-    resObj.put(exec, lengthPropertyName, Number(end - begin), DontEnum | DontDelete);
+    resObj.put(exec, lengthPropertyName, Number(n), DontEnum | DontDelete);
     break;
   }
   case Sort:{