Closed Bug 778421 Opened 13 years ago Closed 13 years ago

Unchecked cast from long to int in NativeArray/NativeJSON

Categories

(Rhino Graveyard :: Core, defect)

Product:
Rhino Graveyard
Component:
Core
Version:
head
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: anba, Unassigned)

Details

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1 Build ID: 20120713134347 Steps to reproduce: See js1_5/Array/regress-157652.js for a test case js> Array.prototype.sort.call({length: 2147483647 + 1}) Exception in thread "main" java.lang.NegativeArraySizeException at org.mozilla.javascript.NativeArray.js_sort(NativeArray.java:1019) at org.mozilla.javascript.NativeArray.execIdCall(NativeArray.java:284) at ...
Merged: https://github.com/mozilla/rhino/commit/7fdd02abbf81eb3f67ca309260dc35866a5f6690
Status: UNCONFIRMED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.