Bug Description
Incorrect handling of unsigned variables causes an undeflow inside Array::arrayPrototypeSplice when calling array.splice(0). This leads to a missed call to DeleteProperty on array elements.
|
while (i > (len - actualDeleteCount + itemCount - 1)) { |
If len == actualDeleteCount (as for array.splice(0)) result expression < 0 for uint64_t and the loop never executes.
Hermes git revision (if applicable): 896ee1e
Steps To Reproduce
An example with Proxy, which is a symptom:
let log = (...args) => typeof print === 'undefined' ? console.log(JSON.stringify(args)) : print(JSON.stringify(args))
let arr = new Proxy([], {
deleteProperty(target, p) {
log('del', target, p)
return Reflect.deleteProperty(target, p)
},
})
arr.push('a', 'b', 'c')
arr.splice(0)Hermes
V8
["del",["a","b","c"],"2"]
["del",["a","b",null],"1"]
["del",["a",null,null],"0"]
Bug Description
Incorrect handling of unsigned variables causes an undeflow inside
Array::arrayPrototypeSplicewhen callingarray.splice(0). This leads to a missed call to DeleteProperty on array elements.hermes/lib/VM/JSLib/Array.cpp
Line 2698 in 6573809
If
len == actualDeleteCount(as forarray.splice(0)) result expression< 0foruint64_tand the loop never executes.gradle cleanand confirmed this bug does not occur with JSCHermes git revision (if applicable): 896ee1e
Steps To Reproduce
An example with Proxy, which is a symptom:
Hermes
V8