Skip to content

Commit

Permalink
Fix casting negative number to usize in Array.splice (#2030)
Browse files Browse the repository at this point in the history
This Pull Request fixes a faulty cast for `Array.splice`. 

Negative values for delete_count were being directly casted to usize, which was not the intended behavior. This pull request fixes the issue by using a fallible conversion, defaulting to 0 if the conversion fails.

It changes the following:

- Replace cast in `Array.splice` prototype method with fallible conversion.
  • Loading branch information
lupd committed Apr 14, 2022
1 parent 34303f1 commit 781561e
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion boa_engine/src/builtins/array/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -2071,7 +2071,9 @@ impl Array {
// c. Let actualDeleteCount be the result of clamping dc between 0 and len - actualStart.
let max = len - actual_start;
match dc {
IntegerOrInfinity::Integer(i) => (i as usize).clamp(0, max),
IntegerOrInfinity::Integer(i) => {
usize::try_from(i).unwrap_or_default().clamp(0, max)
}
IntegerOrInfinity::PositiveInfinity => max,
IntegerOrInfinity::NegativeInfinity => 0,
}
Expand Down

0 comments on commit 781561e

Please sign in to comment.