Browse Source

Fix casting negative number to usize in `Array.splice` (#2030)

This Pull Request fixes a faulty cast for `Array.splice`. 

Negative values for delete_count were being directly casted to usize, which was not the intended behavior. This pull request fixes the issue by using a fallible conversion, defaulting to 0 if the conversion fails.

It changes the following:

- Replace cast in `Array.splice` prototype method with fallible conversion.
pull/2031/head
lupd 2 years ago
parent
commit
781561e047
  1. 4
      boa_engine/src/builtins/array/mod.rs

4
boa_engine/src/builtins/array/mod.rs

@ -2071,7 +2071,9 @@ impl Array {
// c. Let actualDeleteCount be the result of clamping dc between 0 and len - actualStart. // c. Let actualDeleteCount be the result of clamping dc between 0 and len - actualStart.
let max = len - actual_start; let max = len - actual_start;
match dc { match dc {
IntegerOrInfinity::Integer(i) => (i as usize).clamp(0, max), IntegerOrInfinity::Integer(i) => {
usize::try_from(i).unwrap_or_default().clamp(0, max)
}
IntegerOrInfinity::PositiveInfinity => max, IntegerOrInfinity::PositiveInfinity => max,
IntegerOrInfinity::NegativeInfinity => 0, IntegerOrInfinity::NegativeInfinity => 0,
} }

Loading…
Cancel
Save