瀏覽代碼

EnsureCapacity can throw if called against sparse mode array (#746)

Marko Lahma 5 年之前
父節點
當前提交
293161f092
共有 2 個文件被更改,包括 19 次插入5 次删除
  1. 12 0
      Jint.Tests/Runtime/ArrayTests.cs
  2. 7 5
      Jint/Native/Array/ArrayInstance.cs

+ 12 - 0
Jint.Tests/Runtime/ArrayTests.cs

@@ -52,5 +52,17 @@ namespace Jint.Tests.Runtime
 
             Assert.Equal(8, result);
         }
+
+        [Fact]
+        public void LargeArraySize()
+        {
+            const string code = @"
+            let arr = [];
+            for (let i = 0; i < 10000; i++) arr.push(i);
+            for (let i=0;i<10000;i++) arr.splice(0, 1);
+            ";
+            var engine = new Engine();
+            engine.Execute(code);
+        }
     }
 }

+ 7 - 5
Jint/Native/Array/ArrayInstance.cs

@@ -648,13 +648,15 @@ namespace Jint.Native.Array
 
         internal void EnsureCapacity(uint capacity)
         {
-            if (capacity <= MaxDenseArrayLength && capacity > (uint) _dense.Length)
+            if (capacity > MaxDenseArrayLength || _dense is null || capacity <= (uint) _dense.Length)
             {
-                // need to grow
-                var newArray = new PropertyDescriptor[capacity];
-                System.Array.Copy(_dense, newArray, _dense.Length);
-                _dense = newArray;
+                return;
             }
+
+            // need to grow
+            var newArray = new PropertyDescriptor[capacity];
+            System.Array.Copy(_dense, newArray, _dense.Length);
+            _dense = newArray;
         }
 
         public IEnumerator<JsValue> GetEnumerator()