archive-gh-me/jerryscript
1
0
Fork 0
mirror of https://github.com/jerryscript-project/jerryscript.git synced 2025-12-15 16:29:21 +00:00
Code Issues Projects Releases Wiki Activity

Add length check in copy_within's fast path (#4168)

Browse Source 
fixes #4146

JerryScript-DCO-1.0-Signed-off-by: bence gabor kis kisbg@inf.u-szeged.hu
This commit is contained in:
kisbg 2020-08-28 10:55:26 +02:00 committed by GitHub
parent 2aa5f136a4
commit a470fef8a5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
jerry-core/ecma/builtin-objects/ecma-builtin-array-prototype.c
View File

@ -2543,6 +2543,7 @@ ecma_builtin_array_prototype_object_copy_within (const ecma_value_t args[], /**<
{
if (obj_p->u1.property_list_cp != JMEM_CP_NULL)
{
count = JERRY_MIN (ext_obj_p->u.array.length, count);
ecma_value_t *buffer_p = ECMA_GET_NON_NULL_POINTER (ecma_value_t, obj_p->u1.property_list_cp);
for (; count > 0; count--)

49
tests/jerry/es.next/regression-test-issue-4146.js Normal file
View File

@ -0,0 +1,49 @@
// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// helper function - simple implementation
Array.prototype.equals = function (array) {
if (this.length != array.length)
return false;
for (var i = 0; i < this.length; i++) {
if (this[i] instanceof Array && array[i] instanceof Array) {
if (!this[i].equals(array[i]))
return false;
}
else if (this[i] != array[i]) {
return false;
}
}
return true;
}
function longDenseArray(){
var a = [0];
for(var i = 0; i < 200; i++){
a[i] = i;
}
return a;
}
function shorten(){
currArray.length = 20;
return 1;
}
var currArray = longDenseArray();
assert (currArray.copyWithin (200, {valueOf: shorten}).length == 20)
var array = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19];
assert (currArray.copyWithin(200, {valueOf: shorten}).equals (array))