JavaScript xor function

I made simple JavaScript xor function. It accepts string, numeric array and mixed array (char, string, num) as params. It returns string or an array.

Returning an array is a must!. All numbers are printable on screen and there is no potential loss of information. String works excellent if you pass it in a variable. But if you want to print it on screen, there might be some unprintable characters in a string. Like \n \t \cr \lf, or whole array of unprintable unicode char's.

Also array as password is also needed because that's an easy way to have low numbers like [0,1,2,3...] which are not so easy to represent as a string.

My questions are the usual. What do you think of it? Does any improvement come in mind when you look at the code? Did I miss something? Any potential bugs?

/*
    source: string, [1,2,3,...], ['a', 'b', 'c', ...], [1, 'a', 2, 'b', ...]
    password: string, [1,2,3,...], ['a', 'b', 'c', ...], [1, 'a', 2, 'b', ...]
    return type str || []

*/

function xor(source, password, return_type) {
  var ret_ar = [],
    i, len,
    pwlen,
    pwindex = 0,
    s, p;
  if(typeof source === 'string') {
    source = source.split('');
  }
  if(Object.prototype.toString.call(source) === '[object Array]') {
    for(i = 0, len = source.length; i < len; ++i) {
      s = source[i];
      if(typeof s === 'string') {
        source[i] = s.charCodeAt(0);
      } else if(typeof s !== 'number') {
        console.log(s);
        throw("Only str or [number, 'c', 'h',...] in xor \n Bad first param in function xor:" + s);
      }
    }
  } else {
    throw('Very Bad first param in function xor:' + source);
  }
  if(typeof password === 'string') {
    password = password.split('');
  }
  if(Object.prototype.toString.call(password) === '[object Array]') {
    for(i = 0, len = password.length; i < len; ++i) {
      p = password[i];
      if(typeof p === 'string') {
        password[i] = p.charCodeAt(0);
      } else if(typeof p !== 'number') {
        console.log(p);
        throw("Only str or [number, 'c', 'h',...] in xor \n Bad second param in function xor:" + p);
      }
    }
  } else {
    throw('Very Bad second param in function xor:' + p);
  }
  pwindex = 0;
  pwlen = password.length - 1;
  len = source.length;
  if(pwlen >= 0) {
    for(i = 0; i < len; ++i) {
      ret_ar[i] = source[i] ^ password[pwindex]; // unefined ^7 === 7
      if(pwindex >= pwlen) pwindex = 0;
      else ++pwindex;
    }
  } else // ~source on '', undefined passwprd
  {
    for(i = 0; i < len; ++i) {
      ret_ar[i] = ~source[i]; // ~unefined === -1
    }
  }
  source = password = i = pwlen = pwindex = null;
  //debugger;
  if(typeof return_type === 'string') {
    // code -> char . join('')
    return ret_ar.map(function (code) {
      return String.fromCharCode(code)
    }).join('');
  } else {
    return ret_ar;
  }
} // ------------------------- end xor () ----------------------------

Here are tests for function if anyone need it.

out = document.getElementById('my_div');

var str = JSON.stringify(pitanja_ar);
var str = 'small test';
var pass = 'password';
var p_ar = [0,1,2,3,4,5];

out.innerHTML = '';
out.innerHTML += '1.<br> xor (str, pass, str):<br><br>';
var sss =  xor(str, pass, 'str');
out.innerHTML += sss;
out.innerHTML += '<br><br>Equal: ' + (str === xor(sss, pass, 'str'));

out.innerHTML += '<hr><br>2.<br> xor (str, pass, []):<br>';
var ssa = xor(str, pass, []);
out.innerHTML += ssa;
out.innerHTML += '<br><br>Equal: ' + (str === xor(ssa, pass, ''));

out.innerHTML += '<hr><br>3.<br> xor (str, p_ar, str):<br>';
var sas =  xor(str, p_ar, 'str');
out.innerHTML += sas;
out.innerHTML += '<br><br>Equal: ' + (str === xor(sas, p_ar, ''));

out.innerHTML += '<hr><br>4.<br> xor (str, p_ar, []):<br>';
var saa =  xor(str, p_ar, []);
out.innerHTML += saa;
out.innerHTML += '<br><br>Equal: ' + (str === xor(saa, p_ar, ''));

//
pitanja_ar = [1,2,3,4,5,6,7,8,9,10];
out.innerHTML += '<hr><br>5.<br> xor([], pass, str)<br>';
var ass = xor(pitanja_ar, pass, '');
out.innerHTML += ass;
var asa = xor(ass, pass, [])
out.innerHTML += '<br><br>Equal: ' + arrays_equal(pitanja_ar,asa);


out.innerHTML += '<hr><br>6.<br> xor([], pass, [])<br>';
var asa = xor(pitanja_ar, pass, []);
out.innerHTML += asa;
out.innerHTML += '<br><br>Equal: ' + arrays_equal(pitanja_ar,xor(asa, pass, []));



out.innerHTML += '<hr><br>7.<br> xor([], p_ar, str)<br>';
var aas =  xor(pitanja_ar, p_ar, '');
out.innerHTML += aas;
out.innerHTML += '<br><br>Equal: ' + arrays_equal(pitanja_ar, xor(aas, p_ar, []));


out.innerHTML += '<hr><br>8.<br> xor([], p_ar, [])<br>';
var aaa =  xor(pitanja_ar, p_ar, []);
out.innerHTML += aaa;
out.innerHTML += '<br><br>Equal: ' + arrays_equal(pitanja_ar, xor(aaa, p_ar, []));

//