Skip to content

Commit c8c3731

Browse files
itsu-devConstellation
itsu-dev
authored and
Constellation
committed
[JSC] Array.prototype.toSpliced incorrectly throws TypeError instead of RangeError when length is Infinity
https://bugs.webkit.org/show_bug.cgi?id=320830 Reviewed by Yusuke Suzuki. Array.prototype.toSpliced should throw TypeError when the new array length exceeds 2**53-1 (Step 12 of [1]), but it currently throws TypeError for the length of 2**53-1. For this case, it should throw RangeError instead (Step 13 of [1], Step 1 of [2]). To fix this, this commit replaces `>=` with `>` in the implementation of `Array.prototype.toSpliced` to check the new array length. [1]: https://tc39.es/ecma262/2026/multipage/indexed-collections.html#sec-array.prototype.tospliced [2]: https://tc39.es/ecma262/2026/multipage/ordinary-and-exotic-objects-behaviours.html#sec-arraycreate No additional tests. Instead, this commit also modify a exisiting stress test to adjust the specification. * JSTests/stress/change-array-by-copy.js: (shouldThrow): * Source/JavaScriptCore/runtime/ArrayPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): Canonical link: https://commits.webkit.org/320554@main
1 parent a7cd2f5 commit c8c3731

2 files changed

Lines changed: 6 additions & 2 deletions

File tree

‎JSTests/stress/change-array-by-copy.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,14 @@ var sequence = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
8888
// |this| = null.
8989
shouldThrow(() => Array.prototype.toSpliced.call(null, 0, 5), TypeError);
9090

91-
// Length >= 2^53 - 1.
91+
// NewLength > 2^53 - 1 (Number.MAX_SAFE_INTEGER).
9292
var arrayLike = {};
9393
arrayLike.length = 2 ** 53 - 1;
9494
shouldThrow(() => Array.prototype.toSpliced.call(arrayLike, 0, 0, null), TypeError);
95+
96+
// NewLength > 2^32 - 1 (Array-Length Limit).
97+
arrayLike.length = 2 ** 32 - 1;
98+
shouldThrow(() => Array.prototype.toSpliced.call(arrayLike, 0, 0, null), RangeError);
9599
}
96100

97101
//Array.prototype.with()

‎Source/JavaScriptCore/runtime/ArrayPrototype.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2245,7 +2245,7 @@ JSC_DEFINE_HOST_FUNCTION(arrayProtoFuncToSpliced, (JSGlobalObject* globalObject,
22452245

22462246
uint64_t newLen = length + insertCount - deleteCount;
22472247

2248-
if (newLen >= maxSafeIntegerAsUInt64()) [[unlikely]] {
2248+
if (newLen > maxSafeIntegerAsUInt64()) [[unlikely]] {
22492249
throwTypeError(globalObject, scope, "Array length exceeds 2**53 - 1"_s);
22502250
return { };
22512251
}

0 commit comments

Comments
 (0)