Backed out changeset 9345403c7628 (bug 1171036)

--HG--
extra : rebase_source : 60f044bf4daf139f536196cbba6986e795eb902d

js/src/jsarray.cpp

@@ -83,13 +83,12 @@ js::GetLengthProperty(JSContext* cx, HandleObject obj, uint32_t* lengthp)
     if (!GetProperty(cx, obj, obj, cx->names().length, &value))
         return false;
 
-    bool overflow;
-    if (!ToLengthClamped(cx, value, lengthp, &overflow)) {
-        if (!overflow)
-            return false;
-        *lengthp = UINT32_MAX;
+    if (value.isInt32()) {
+        *lengthp = uint32_t(value.toInt32()); // uint32_t cast does ToUint32
+        return true;
     }
-    return true;
+
+    return ToUint32(cx, value, lengthp);
 }
 
 /*

js/src/tests/ecma_5/Array/unshift-01.js

@@ -13,14 +13,10 @@ print(BUGNUMBER + ": " + summary);
  * BEGIN TEST *
  **************/
 
-// ES6 ToLength clamps length values to 2^53 - 1.
-// We currently clamp to 2^32 - 1 instead. See bug 924058.
-var MAX_LENGTH = 0xffffffff;
-
 var a = {};
-a.length = MAX_LENGTH + 1;
-assertEq([].unshift.call(a), MAX_LENGTH);
-assertEq(a.length, MAX_LENGTH);
+a.length = 4294967296;
+assertEq([].unshift.call(a), 0);
+assertEq(a.length, 0);
 
 function testGetSet(len, expected) {
     var newlen;
@@ -34,8 +30,8 @@ testGetSet(0, 0);
 testGetSet(10, 10);
 testGetSet("1", 1);
 testGetSet(null, 0);
-testGetSet(MAX_LENGTH + 2, MAX_LENGTH);
-testGetSet(-5, 0);
+testGetSet(4294967297, 1);
+testGetSet(-5, 4294967291);
 
 /******************************************************************************/