From 33be4883a2733153f70dc7bccc7980f2aba60b95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zsolt=20Borb=C3=A9ly?=
 <zsborbely.u-szeged@partner.samsung.com>
Date: Mon, 20 Jul 2015 09:01:36 +0200
Subject: [PATCH] Fix Array.prototype.splice() deletecount calculation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JerryScript-DCO-1.0-Signed-off-by: Zsolt Borbély zsborbely.u-szeged@partner.samsung.com
---
 .../ecma-builtin-array-prototype.cpp          |  5 ++++
 tests/jerry/array-prototype-splice.js         | 28 +++++++++++++------
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp b/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp
index 7f3adf6c3..506be6fdd 100644
--- a/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp
+++ b/jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.cpp
@@ -1462,6 +1462,11 @@ ecma_builtin_array_prototype_object_splice (ecma_value_t this_arg, /**< this arg
         else
         {
           delete_count = ecma_number_is_infinity (delete_num) ? len : ecma_number_to_uint32 (delete_num);
+
+          if (delete_count > len - start)
+          {
+            delete_count = len - start;
+          }
         }
       }
       else
diff --git a/tests/jerry/array-prototype-splice.js b/tests/jerry/array-prototype-splice.js
index 14789f0f8..df583f5ad 100644
--- a/tests/jerry/array-prototype-splice.js
+++ b/tests/jerry/array-prototype-splice.js
@@ -29,7 +29,7 @@ assert (array[3] == "sunshine");
 assert (array1.length == 0);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array2 = array.splice(2);
 
 assert (array.length == 2);
@@ -40,7 +40,7 @@ assert (array2[0] == -127);
 assert (array2[1] == "sunshine");
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array3 = array.splice(2, 1);
 
 assert (array.length == 3);
@@ -51,7 +51,7 @@ assert (array3.length == 1);
 assert (array3[0] == -127);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array4 = array.splice(0, 3, 6720, "Szeged");
 
 assert (array.length == 3);
@@ -64,7 +64,7 @@ assert (array4[1] == undefined);
 assert (array4[2] == -127);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array5 = array.splice(-2, -2, 6720, "Szeged");
 
 assert (array.length == 6);
@@ -77,7 +77,7 @@ assert (array[5] == "sunshine");
 assert (array5.length == 0);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array6 = array.splice(undefined, undefined, undefined);
 
 assert (array.length == 5);
@@ -89,7 +89,7 @@ assert (array[4] == "sunshine");
 assert (array6.length == 0);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array7 = array.splice(Infinity, NaN);
 assert (array.length == 4);
 assert (array[0] == 54);
@@ -99,7 +99,7 @@ assert (array[3] == "sunshine");
 assert (array7.length == 0);
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array8 = array.splice(-Infinity, Infinity);
 
 assert (array.length == 0);
@@ -110,7 +110,7 @@ assert (array8[2] == -127);
 assert (array8[3] == "sunshine");
 
 // --------------------------------------------------------
-array = setDefaultValues();
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
 var array9 = array.splice(NaN, -Infinity);
 assert (array.length == 4);
 assert (array[0] == 54);
@@ -119,6 +119,18 @@ assert (array[2] == -127);
 assert (array[3] == "sunshine");
 assert (array9.length == 0);
 
+// --------------------------------------------------------
+array = setDefaultValues(); // 54, undefined, -127, "sunshine"
+var array10 = array.splice(-3, 4, Infinity, "university");
+assert (array.length == 3);
+assert (array[0] == 54);
+assert (array[1] == Infinity);
+assert (array[2] == "university");
+assert (array10.length == 3);
+assert (array10[0] == undefined);
+assert (array10[1] == -127);
+assert (array10[2] == "sunshine");
+
 // Checking behavior when unable to get length
 var obj = {splice : Array.prototype.splice};
 Object.defineProperty(obj, 'length', { 'get' : function () { throw new ReferenceError ("foo"); } });