Bug 185127 – Slicing an ArrayBuffer with a long number returns an ArrayBuffer with byteLength zero

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Arthur Lapprand]

Hi there,

There's seems to be an inconsistence when slicing an ArrayBuffer with a long number.

Tag: 606.1.9.4
OS: Ubuntu 16.04 x86_64

Steps to reproduce the problem:
    var a = new ArrayBuffer(5);
    var b = a.slice (3, 4294967297);
    if(b.byteLength !== 0) throw new Error("Test failed");

Expected results: 
Error: Test failed

Actual results:
Pass without failures

The end result is that the test should fail as the slice for range (3, 4294967297) should return the value 2. In JavaScriptCore it returns zero, making the test pass. Other JavaScript engines such as V8, SpiderMonkey and Chakra failed the test as expected.

cinfuzz

[Keith Miller]

Created attachment 346933 [details]
Patch

[Saam Barati]

Comment on attachment 346933 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=346933&action=review

> Source/JavaScriptCore/runtime/ArrayBuffer.cpp:284
> +        index = currentLength + index;

What if the magnitude of index is > currentLength?

> JSTests/test262/expectations.yaml:711
> +test/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js:

How am I supposed to be reading this? Are these all new failures?

[Keith Miller]

Comment on attachment 346933 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=346933&action=review

>> Source/JavaScriptCore/runtime/ArrayBuffer.cpp:284
>> +        index = currentLength + index;
> 
> What if the magnitude of index is > currentLength?

It will get clamped to zero in clampValue.

>> JSTests/test262/expectations.yaml:711
>> +test/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js:
> 
> How am I supposed to be reading this? Are these all new failures?

Yeah, because we would throw a type error about not enough arguments. Which isn't really the right error. Since I removed that code we no longer throw an error since we don't do the species stuff.

[Keith Miller]

Committed r234777: <https://trac.webkit.org/changeset/234777>

[Radar WebKit Bug Importer]

<rdar://problem/43162095>