uint64_t underflow inside Array::arrayPrototypeSplice

Open Beginner friendly
#1,912 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
compilers

Research direction

Start in lib/VM/JSLib/Array.cpp at Array::arrayPrototypeSplice near line 2698, then run the Proxy reproduction with array.splice(0). Check the unsigned loop-bound calculation and verify that the fix causes deleteProperty to be invoked for indices 2, 1, and 0, matching the V8 output.

Written by the indexing model from the issue text.

Description

bug

Bug Description

Incorrect handling of unsigned variables causes an undeflow inside Array::arrayPrototypeSplice when calling array.splice(0). This leads to a missed call to DeleteProperty on array elements.

https://github.com/facebook/hermes/blob/657380912e05dda0dda49a9e1204f9166442d737/lib/VM/JSLib/Array.cpp#L2698

If len == actualDeleteCount (as for array.splice(0)) result expression < 0 for uint64_t and the loop never executes.

  • I have run gradle clean and confirmed this bug does not occur with JSC
  • The issue is reproducible with the latest version of React Native.

Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/896ee1e4377bc81823212a4abdef482d659948b1

Steps To Reproduce

An example with Proxy, which is a symptom:

let log = (...args) => typeof print === 'undefined' ? console.log(JSON.stringify(args)) : print(JSON.stringify(args))

let arr = new Proxy([], {
	deleteProperty(target, p) {
		log('del', target, p)
		return Reflect.deleteProperty(target, p)
	},
})

arr.push('a', 'b', 'c')
arr.splice(0)

Hermes

no messages

V8

["del",["a","b","c"],"2"]
["del",["a","b",null],"1"]
["del",["a",null,null],"0"]
Dominant language
JavaScript
Stars
11.3k
Forks
865
Avg merge
2h 4m
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from facebook/hermes

All issues in facebook/hermes

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.