From: Fabrice Bellard <fabrice@bellard.org>
Date: Sat, 26 Sep 2026 13:01:46 +0000 (+0200)
Subject:  Reject out-of-range limits in Iterator.prototype.take/drop
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=d88b1ed67e83e294b1c5f30453022689e61fed1d;p=quickjs.git

 Reject out-of-range limits in Iterator.prototype.take/drop
---

diff --git a/quickjs.c b/quickjs.c
index eb93ac5..adfed75 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -44090,32 +44090,20 @@ static JSValue js_create_iterator_helper(JSContext *ctx, JSValueConst this_val,
     case JS_ITERATOR_HELPER_KIND_DROP:
     case JS_ITERATOR_HELPER_KIND_TAKE:
         {
-            JSValue v;
             double dlimit;
-            v = JS_ToNumber(ctx, argv[0]);
-            if (JS_IsException(v))
-                goto fail;
-            // Check for Infinity.
-            if (JS_ToFloat64(ctx, &dlimit, v)) {
-                JS_FreeValue(ctx, v);
+            if (JS_ToFloat64(ctx, &dlimit, argv[0]))
                 goto fail;
-            }
-            if (isnan(dlimit)) {
-                JS_FreeValue(ctx, v);
+            if (isnan(dlimit))
                 goto range_error;
-            }
-            if (!isfinite(dlimit)) {
-                JS_FreeValue(ctx, v);
-                if (dlimit < 0)
+            if (dlimit < INT64_MIN) {
+                count = INT64_MIN;
+            } else if (dlimit > MAX_SAFE_INTEGER) {
+                if (isfinite(dlimit))
                     goto range_error;
                 else
                     count = MAX_SAFE_INTEGER;
             } else {
-                v = JS_ToIntegerFree(ctx, v);
-                if (JS_IsException(v))
-                    goto fail;
-                if (JS_ToInt64Free(ctx, &count, v))
-                    goto fail;
+                count = (int64_t)dlimit;
             }
             if (count < 0)
                 goto range_error;
diff --git a/test262_errors.txt b/test262_errors.txt
index 8ee4c2b..6f59bca 100644
--- a/test262_errors.txt
+++ b/test262_errors.txt
@@ -5,18 +5,6 @@ test262/test/annexB/language/expressions/assignmenttargettype/callexpression-in-
 test262/test/annexB/language/expressions/assignmenttargettype/callexpression-in-prefix-update.js:27: SyntaxError: invalid increment/decrement operand
 test262/test/annexB/language/expressions/assignmenttargettype/callexpression.js:33: SyntaxError: invalid assignment left-hand side
 test262/test/annexB/language/expressions/assignmenttargettype/cover-callexpression-and-asyncarrowhead.js:20: SyntaxError: invalid assignment left-hand side
-test262/test/built-ins/Iterator/prototype/drop/argument-effect-order.js:27: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/drop/argument-effect-order.js:27: strict mode: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/drop/argument-validation-failure-closes-underlying.js:18: Test262Error: Expected a RangeError but got a Test262Error
-test262/test/built-ins/Iterator/prototype/drop/argument-validation-failure-closes-underlying.js:18: strict mode: Test262Error: Expected a RangeError but got a Test262Error
-test262/test/built-ins/Iterator/prototype/drop/limit-rangeerror.js:29: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/drop/limit-rangeerror.js:29: strict mode: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/take/argument-effect-order.js:44: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/take/argument-effect-order.js:44: strict mode: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/take/argument-validation-failure-closes-underlying.js:18: Test262Error: Expected a RangeError but got a Test262Error
-test262/test/built-ins/Iterator/prototype/take/argument-validation-failure-closes-underlying.js:18: strict mode: Test262Error: Expected a RangeError but got a Test262Error
-test262/test/built-ins/Iterator/prototype/take/limit-rangeerror.js:29: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
-test262/test/built-ins/Iterator/prototype/take/limit-rangeerror.js:29: strict mode: Test262Error: Expected a RangeError to be thrown but no exception was thrown at all
 test262/test/built-ins/Promise/try/avoids-wrap-for-subclass.js:10: Test262Error: Expected SameValue(«[object Promise]», «[object Promise]») to be true
 test262/test/built-ins/Promise/try/avoids-wrap-for-subclass.js:10: strict mode: Test262Error: Expected SameValue(«[object Promise]», «[object Promise]») to be true
 test262/test/built-ins/Promise/try/avoids-wrap.js:10: Test262Error: Expected SameValue(«[object Promise]», «[object Promise]») to be true