Array iterator, Proxy ownKeys and RegExp @@replace read `length` with ToUint32 instead of ToLength

Aperta
  • Qualcosa non va?
#1,890 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
57/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, javascript
Ambito
backend, operating-systems

Direzione di ricerca

Start by reading js_array_iterator_next, js_proxy_get_own_property_names, js_regexp_Symbol_replace, and js_string_GetSubstitution, which the issue identifies as using js_get_length32(). Compare with the js_get_length64() change in #1816 and the relevant ECMAScript length rules. Done means the reported negative and above-2^32 cases follow ToLength semantics, with limits handled without wrapping; run the reproductions and the related tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Environment
  • QuickJS-ng v0.18.0 (d7215b0) and master e22ce4d (2026-11-02), built with make, Debian 12 x86-64, gcc 12.2
  • Also seen in v0.15.0
  • Reference: node v26.13.0
  • Checked on 2026-11-03
Reproduction
// 1. array iterator, negative length (terminates)
var n = 0;
for (var x of Array.prototype.values.call({ length: -1, 0: "a" })) { if (++n > 3) break; }
console.log(n);                       // expected 0, actual 4

// 2. array iterator, length above 2**32 wraps
n = 0;
for (var k of Array.prototype.keys.call({ length: 2 ** 32 + 1 })) { if (++n > 5) break; }
console.log(n);                       // expected 6, actual 1

// 3. Proxy ownKeys trap result with a negative length
console.log(Reflect.ownKeys(new Proxy({}, { ownKeys() { return { length: -1, 0: "a" }; } })).length);
                                      // expected 0, actual TypeError

// 4. Proxy ownKeys trap result with length 2**32 + 1
console.log(Reflect.ownKeys(new Proxy({}, { ownKeys() { return { length: 2 ** 32 + 1, 0: "a" }; } })).length);
                                      // expected TypeError (index 1 is undefined) or a RangeError limit, actual 1

These do not terminate (about 2^32 iterations), run with a timeout:

console.log([...Array.prototype.values.call({ length: -1, 0: "a" })].length);   // expected 0

var re = /x/;
re.exec = function () { re.exec = () => null; return { length: -1, 0: "x", index: 0 }; };
console.log("x".replace(re, "[$&]"));                                           // expected [x]
Expected (spec)

All of these read the length with LengthOfArrayLike, that is
ToLength(Get(obj, "length")), which clamps to [0, 2^53 − 1]: ToLength(−1) is 0, and 2^32 + 1 stays 2^32 + 1.

ToUint32 maps −1 to 2^32 − 1 and 2^32 + 1 to 1, which explains every result above.

Cause

These sites use js_get_length32() (ToUint32):

  • js_array_iterator_next
  • js_proxy_get_own_property_names
  • js_regexp_Symbol_replace (nCaptures) and js_string_GetSubstitution (captures)

A possible fix (not written or tested): read the length with js_get_length64() (ToLength), as #1816 does for
build_arg_list. Above what a site can represent, throw a RangeError instead of wrapping (ownKeys, captures), or use a
64-bit index (the array iterator).

Related
  • #1764 / #1816: the same conversion in build_arg_list (Function.prototype.apply, Reflect.apply, Reflect.construct). That PR does not touch the sites above.
  • #1609: fixed an allocation overflow in the Proxy ownKeys path. The length conversion there is still ToUint32.
  • bellard/quickjs has the same code at these sites (its apply already uses ToLength).
Lingua principale
C
Stelle
3.9k
Fork
389
Merge medio
4g 5h
PR unite (30g)
16

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di quickjs-ng/quickjs

Tutte le issue di quickjs-ng/quickjs

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.