mirror of
https://github.com/RGBCube/serenity
synced 2025-07-27 10:47:35 +00:00
LibJS: Fix substr() with negative arguments larger than string length
length_in_code_units() returns a size_t, which is 64-bit unsigned in i686 builds. `size + (i32)int_length` hence produced a 64-bit unsigned result, so a negative value would wrap around and become a very large number. As fix, just omit the cast -- we assign the result of max() to a double anyways. With this, all test262 tests in annexB/built-ins/String/prototype pass.
This commit is contained in:
parent
23cde7685c
commit
1b944b4c41
2 changed files with 4 additions and 1 deletions
|
@ -4,6 +4,9 @@ test("basic functionality", () => {
|
|||
expect("".substr(1)).toBe("");
|
||||
expect("".substr()).toBe("");
|
||||
expect("".substr(-1)).toBe("");
|
||||
expect("a".substr(-1)).toBe("a");
|
||||
expect("a".substr(-2)).toBe("a");
|
||||
expect("a".substr(-3)).toBe("a");
|
||||
expect("hello friends".substr()).toBe("hello friends");
|
||||
expect("hello friends".substr(1)).toBe("ello friends");
|
||||
expect("hello friends".substr(0, 5)).toBe("hello");
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue