diff --git a/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.cpp b/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.cpp index 61ab53e229..bdefe6d38b 100644 --- a/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.cpp +++ b/jerry-core/ecma/builtin-objects/ecma-builtin-helpers.cpp @@ -299,21 +299,29 @@ ecma_builtin_helper_array_index_normalize (ecma_number_t index, /**< index */ } else { - const int32_t int_index = ecma_number_to_int32 (index); - - if (int_index < 0) + if (ecma_number_is_negative (index)) { - const uint32_t uint_index = (uint32_t) - int_index; - norm_index = uint_index > length ? 0 : length - uint_index; + ecma_number_t index_neg = ecma_number_negate (index); + + if (index_neg > length) + { + norm_index = 0; + } + else + { + norm_index = length - ecma_number_to_uint32 (index_neg); + } } else { - norm_index = (uint32_t) int_index; - - if (norm_index > length) + if (index > length) { norm_index = length; } + else + { + norm_index = ecma_number_to_uint32 (index); + } } } } diff --git a/tests/jerry/array-prototype-slice.js b/tests/jerry/array-prototype-slice.js index 9948418a27..a9d1348cce 100644 --- a/tests/jerry/array-prototype-slice.js +++ b/tests/jerry/array-prototype-slice.js @@ -58,6 +58,27 @@ assert (array7[3] == -127); assert (array8.length == 0); +var array = []; +array[4294967293] = "foo"; +array.length = 4294967295; +var result = array.slice(4294967293, -1) +assert(result.length === 1) +assert(result[0] === "foo") + +array[0] = "bar"; +var result = array.slice(-4294967295, -4294967294) +assert(result.length === 1) +assert(result[0] === "bar") + +var array = []; +array[0] = "foo"; +var result = array.slice(4294967296, 4294967297); +assert(result.length === 0); + +array[4294967293] = "bar"; +var result = array.slice(-4294967297, -4294967296); +assert(result.length === 0); + // Checking behavior when unable to get length var obj = { slice : Array.prototype.slice }; Object.defineProperty(obj, 'length', { 'get' : function () { throw new ReferenceError ("foo"); } }); diff --git a/tests/jerry/array-prototype-splice.js b/tests/jerry/array-prototype-splice.js index 14789f0f83..4e1e23f2ed 100644 --- a/tests/jerry/array-prototype-splice.js +++ b/tests/jerry/array-prototype-splice.js @@ -119,6 +119,19 @@ assert (array[2] == -127); assert (array[3] == "sunshine"); assert (array9.length == 0); +var array = []; +array[4294967294] = "foo"; +var result = array.splice(4294967294, 1, "x") +assert(result.length === 1) +assert(result[0] === "foo") +assert(array[4294967294] === "x") + +array[0] = "bar"; +var result = array.splice(-4294967295, 1, "y"); +assert(result.length === 1) +assert(result[0] === "bar") +assert(array[0] === "y") + // Checking behavior when unable to get length var obj = {splice : Array.prototype.splice}; Object.defineProperty(obj, 'length', { 'get' : function () { throw new ReferenceError ("foo"); } });