uint64_t underflow inside Array::arrayPrototypeSplice
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- compilers
Research direction
Start in lib/VM/JSLib/Array.cpp at Array::arrayPrototypeSplice near line 2698, then run the Proxy reproduction with array.splice(0). Check the unsigned loop-bound calculation and verify that the fix causes deleteProperty to be invoked for indices 2, 1, and 0, matching the V8 output.
Written by the indexing model from the issue text.
Description
Bug Description
Incorrect handling of unsigned variables causes an undeflow inside Array::arrayPrototypeSplice when calling array.splice(0). This leads to a missed call to DeleteProperty on array elements.
If len == actualDeleteCount (as for array.splice(0)) result expression < 0 for uint64_t and the loop never executes.
- I have run
gradle cleanand confirmed this bug does not occur with JSC - The issue is reproducible with the latest version of React Native.
Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/896ee1e4377bc81823212a4abdef482d659948b1
Steps To Reproduce
An example with Proxy, which is a symptom:
let log = (...args) => typeof print === 'undefined' ? console.log(JSON.stringify(args)) : print(JSON.stringify(args))
let arr = new Proxy([], {
deleteProperty(target, p) {
log('del', target, p)
return Reflect.deleteProperty(target, p)
},
})
arr.push('a', 'b', 'c')
arr.splice(0)
Hermes
no messages
V8
["del",["a","b","c"],"2"]
["del",["a","b",null],"1"]
["del",["a",null,null],"0"]
- Dominant language
- JavaScript
- Stars
- 11.3k
- Forks
- 865
- Avg merge
- 2h 4m
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from facebook/hermes
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·