Skip to content

Commit 096c956

Browse files
committed
Add new check for a special corner case to typedarray lastIndexOf
Fixes #3129 We need to check if we use the lastIndexOf method and if the second argument is a number, negative, and its absolute value is bigger than the length, then we should return with -1. JerryScript-DCO-1.0-Signed-off-by: Adam Szilagyi [email protected]
1 parent 25b81c1 commit 096c956

File tree

2 files changed

+30
-7
lines changed

2 files changed

+30
-7
lines changed

jerry-core/ecma/builtin-objects/typedarray/ecma-builtin-typedarray-prototype.c

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1719,7 +1719,8 @@ ecma_builtin_typedarray_prototype_index_helper (ecma_value_t this_arg, /**< this
17191719
uint32_t from_index;
17201720

17211721
if (args_number == 0
1722-
|| length == 0)
1722+
|| length == 0
1723+
|| !ecma_is_value_number (args[0]))
17231724
{
17241725
return ecma_make_integer_value (-1);
17251726
}
@@ -1736,12 +1737,17 @@ ecma_builtin_typedarray_prototype_index_helper (ecma_value_t this_arg, /**< this
17361737
return ECMA_VALUE_ERROR;
17371738
}
17381739

1739-
from_index = ecma_builtin_helper_array_index_normalize (num_var, length, is_last_index_of);
1740-
}
1741-
1742-
if (!ecma_is_value_number (args[0]))
1743-
{
1744-
return ecma_make_integer_value (-1);
1740+
if (!ecma_number_is_nan (num_var)
1741+
&& is_last_index_of
1742+
&& num_var < 0
1743+
&& (uint32_t) abs ((int) num_var) > length)
1744+
{
1745+
return ecma_make_integer_value (-1);
1746+
}
1747+
else
1748+
{
1749+
from_index = ecma_builtin_helper_array_index_normalize (num_var, length, is_last_index_of);
1750+
}
17451751
}
17461752

17471753
ecma_number_t search_num = ecma_get_number_from_value (args[0]);
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Copyright JS Foundation and other contributors, http://js.foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
var arrb = new ArrayBuffer(1);
16+
var arr = new Uint8Array(arrb);
17+
arr.lastIndexOf(Number.NaN, -[4294967280]);

0 commit comments

Comments
 (0)