Skip to content

Truncate set-like size before the negative check - #1750

Open
ethanstoner wants to merge 1 commit into
quickjs-ng:masterfrom
ethanstoner:fix-set-size
Open

ethanstoner wants to merge 1 commit into
quickjs-ng:masterfrom
ethanstoner:fix-set-size

Conversation

@ethanstoner

Copy link
Copy Markdown
Contributor

Fixes #1731.

GetSetRecord runs ToIntegerOrInfinity on the size before checking it against zero, so a size in (-1, 0) becomes 0 and is legal. js_setlike_get_props checked the raw number, which threw RangeError for -0.5. Check for NaN first, truncate, then do the negative check, as the spec orders it.

new Set().intersection({ get has() { throw 0; }, size: -0.5 });
// before: RangeError: .size is not a legal size
// after:  0 (thrown by the has getter)

Added tests/bug1731.js. make test passes (0/118 errors) and test262 built-ins/Set is 0/383 errors before and after.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Set.prototype.intersection throws RangeError for size in (-1, 0)

1 participant