From 781561e04790b3b55a14c261efa928b3dc9d7341 Mon Sep 17 00:00:00 2001
From: lupd <93457935+lupd@users.noreply.github.com>
Date: Thu, 14 Apr 2022 23:07:24 +0000
Subject: [PATCH] Fix casting negative number to usize in `Array.splice`
 (#2030)

This Pull Request fixes a faulty cast for `Array.splice`.

Negative values for delete_count were being directly casted to usize, which was not the intended behavior. This pull request fixes the issue by using a fallible conversion, defaulting to 0 if the conversion fails.

It changes the following:

- Replace cast in `Array.splice` prototype method with fallible conversion.
---
 boa_engine/src/builtins/array/mod.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/boa_engine/src/builtins/array/mod.rs b/boa_engine/src/builtins/array/mod.rs
index 38f1c31bde..c31fd8f8a5 100644
--- a/boa_engine/src/builtins/array/mod.rs
+++ b/boa_engine/src/builtins/array/mod.rs
@@ -2071,7 +2071,9 @@ impl Array {
             // c. Let actualDeleteCount be the result of clamping dc between 0 and len - actualStart.
             let max = len - actual_start;
             match dc {
-                IntegerOrInfinity::Integer(i) => (i as usize).clamp(0, max),
+                IntegerOrInfinity::Integer(i) => {
+                    usize::try_from(i).unwrap_or_default().clamp(0, max)
+                }
                 IntegerOrInfinity::PositiveInfinity => max,
                 IntegerOrInfinity::NegativeInfinity => 0,
             }