Ensure collection methods treat array-like objects with invalid length properties as regular objects.

Former-commit-id: dd8b382635bc30dc6e417cd9b47c36abfdf5ddcb

lodash.js

@@ -215,7 +215,7 @@
     // the following branch is for iterating arrays and array-like objects
     '<% if (arrayBranch) { %>' +
     'var length = <%= firstArg %>.length; index = -1;' +
-    '  <% if (objectBranch) { %>\nif (typeof length == \'number\') {<% } %>\n' +
+    '  <% if (objectBranch) { %>\nif (typeof length === length >>> 0) {<% } %>\n' +
     '  <%= arrayBranch.beforeLoop %>;\n' +
     '  while (<%= arrayBranch.loopExp %>) {\n' +
     '    <%= arrayBranch.inLoop %>;\n' +
@@ -804,7 +804,7 @@
     if(thisArg) {
       callback = iteratorBind(callback, thisArg);
     }
-    if (typeof length == 'number') {
+    if (length === length >>> 0) {
       if (length && noaccum) {
         accumulator = collection[--length];
       }
@@ -895,7 +895,7 @@
       return collection.toArray();
     }
     var length = collection.length;
-    if (typeof length == 'number') {
+    if (length === length >>> 0) {
       return slice.call(collection);
     }
     return values(collection);
@@ -3391,7 +3391,7 @@
       }
       // IE compatibility mode and IE < 9 have buggy Array `shift()` and `splice()`
       // functions that fail to remove the last element, `value[0]`, of
-      // array-like-objects even though the `length` property is set to `0`.
+      // array-like objects even though the `length` property is set to `0`.
       // The `shift()` method is buggy in IE 8 compatibility mode, while `splice()`
       // is buggy regardless of mode in IE < 9 and buggy in compatibility mode in IE 9.
       if (value.length === 0) {

test/test.js

@@ -233,6 +233,14 @@
       var collection = [1, 2, 3];
       equal(_.forEach(collection, Boolean), collection);
     });
+
+    test('should treat array-like object with invalid `length` as a regular object', function() {
+      var keys = [],
+          object = { 'length': -1 };
+
+      _.forEach(object, function(value, key) { keys.push(key); });
+      deepEqual(keys, ['length']);
+    });
   }());
 
   /*--------------------------------------------------------------------------*/
@@ -521,6 +529,17 @@
 
       deepEqual(args, ['C', 'B', 'b', object]);
     });
+
+    test('should treat array-like object with invalid `length` as a regular object', function() {
+      var args,
+          object = { 'a': 'A', 'length': -1 };
+
+      _.reduceRight(object, function() {
+        args || (args = slice.call(arguments));
+      });
+
+      deepEqual(args, [-1, 'A', 'a', object]);
+    });
   }());
 
   /*--------------------------------------------------------------------------*/
@@ -622,11 +641,16 @@
       deepEqual(_.toArray(array), [3, 2, 1]);
     });
 
-    test('should treat array-like-objects like arrays', function() {
+    test('should treat array-like objects like arrays', function() {
       var object = { '0': 'a', '1': 'b', '2': 'c', 'length': 3 };
       deepEqual(_.toArray(object), ['a', 'b', 'c']);
       deepEqual(_.toArray(args), [1, 2, 3]);
     });
+
+    test('should treat array-like object with invalid `length` as a regular object', function() {
+      var object = { 'length': -1 };
+      deepEqual(_.toArray(object), [-1]);
+    });
   }(1, 2, 3));
 
   /*--------------------------------------------------------------------------*/