RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 17:12:43 +00:00
Code Issues Activity Actions

LibJS: Fix that length was sometimes cast to [ui]32

Browse source 
Since array-like objects can have much larger lengths even a u32 is not
sufficient.
This commit is contained in:
davidot 2021-07-07 14:09:32 +02:00 • committed by Linus Groh
parent 7310713d11
commit a70033481d
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibJS/Runtime/ArrayPrototype.cpp
View file

@ -362,7 +362,7 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayPrototype::push)
if (vm.exception())
return {};
}
auto new_length_value = Value((i32)new_length);
auto new_length_value = Value(new_length);
this_object->set(vm.names.length, new_length_value, true);
if (vm.exception())
return {};
@ -440,7 +440,7 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayPrototype::pop)
this_object->delete_property_or_throw(index);
if (vm.exception())
return {};
this_object->set(vm.names.length, Value((i32)index), true);
this_object->set(vm.names.length, Value(index), true);
if (vm.exception())
return {};
return element;
@ -1713,7 +1713,7 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayPrototype::splice)
return {};
}
this_object->set(vm.names.length, Value((i32)new_length), true);
this_object->set(vm.names.length, Value(new_length), true);
if (vm.exception())
return {};