18 comments (18 comments)0 reactions (0 reactions)0 assignees (0 assignees)HTML1,409 forks (1,409 forks)batch import
good first issueneeds consensusneeds test262 testsnormative change
Repository metrics
- Stars
- 15,626 stars (15,626 stars)
- PR merge metrics
- Avg merge 92d 19h (Avg merge 92d 19h)17 merged PRs in 30d (17 merged PRs in 30d)
Description
ArrayAccumulation computes the array index via ToString(ToUint32(nextIndex+padding)). This means the index may become 2^32-1. But that's not a valid array index anymore since it is the max value of the length property.
Contributor guide
- Research direction
- Examine the ArrayAccumulation algorithm in the ECMAScript specification and verify whether `ToString(ToUint32(nextIndex+padding))` can produce an index value of 2^32-1, which is not a valid array index. Propose a fix to ensure the index is within valid range.
- Tech stack
- javascript
- Domain
- documentation
- Issue type
- Bug
- Prerequisites
- None