From 66fdddf173f7074d11a26f4c04d1d43a5eecc711 Mon Sep 17 00:00:00 2001
From: Fabrice Bellard <fabrice@bellard.org>
Date: Sat, 7 Nov 2026 14:18:02 +0100
Subject: [PATCH] Apply ToIndex to the maxByteLength option of the ArrayBuffer
 constructor (devanshc777)

---
 quickjs.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/quickjs.c b/quickjs.c
index 49e03a1..a15818e 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -60765,10 +60765,10 @@ static JSValue js_array_buffer_constructor0(JSContext *ctx, JSValueConst new_tar
  {
     uint64_t len, max_len, *pmax_len = NULL;
     JSValue obj, val;
-    int64_t i;
-
-     if (JS_ToIndex(ctx, &len, argv[0]))
-         return JS_EXCEPTION;
+    int ret;
+    
+    if (JS_ToIndex(ctx, &len, argv[0]))
+        return JS_EXCEPTION;
     if (argc < 2)
         goto next;
     if (!JS_IsObject(argv[1]))
@@ -60782,12 +60782,12 @@ static JSValue js_array_buffer_constructor0(JSContext *ctx, JSValueConst new_tar
         return JS_EXCEPTION;
     if (JS_IsUndefined(val))
         goto next;
-    if (JS_ToInt64Free(ctx, &i, val))
+    ret = JS_ToIndex(ctx, &max_len, val);
+    JS_FreeValue(ctx, val);
+    if (ret)
         return JS_EXCEPTION;
-    // don't have to check i < 0 because len >= 0
-    if (len > i || i > MAX_SAFE_INTEGER)
+    if (len > max_len)
         return JS_ThrowRangeError(ctx, "invalid array buffer max length");
-    max_len = i;
     pmax_len = &max_len;
 next:
     return js_array_buffer_constructor2(ctx, new_target, len, pmax_len,
-- 
2.47.3