Add length check in copy_within's fast path (#4168)

fixes #4146 JerryScript-DCO-1.0-Signed-off-by: bence gabor kis kisbg@inf.u-szeged.hu
2020-08-28 10:55:26 +02:00
parent 2aa5f136a4
commit a470fef8a5
2 changed files with 50 additions and 0 deletions
@@ -2543,6 +2543,7 @@ ecma_builtin_array_prototype_object_copy_within (const ecma_value_t args[], /**<
    {
      if (obj_p->u1.property_list_cp != JMEM_CP_NULL)
      {
+        count = JERRY_MIN (ext_obj_p->u.array.length, count);
        ecma_value_t *buffer_p = ECMA_GET_NON_NULL_POINTER (ecma_value_t, obj_p->u1.property_list_cp);

        for (; count > 0; count--)