EnsureCapacity can throw if called against sparse mode array (#746)

sebastienros · Jun 8, 2020 · 293161f · 293161f
1 parent 56ca37b
commit 293161f
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 5 deletions.
diff --git a/Jint.Tests/Runtime/ArrayTests.cs b/Jint.Tests/Runtime/ArrayTests.cs
@@ -52,5 +52,17 @@ public void EmptyStringKey()
 
             Assert.Equal(8, result);
         }
+
+        [Fact]
+        public void LargeArraySize()
+        {
+            const string code = @"
+            let arr = [];
+            for (let i = 0; i < 10000; i++) arr.push(i);
+            for (let i=0;i<10000;i++) arr.splice(0, 1);
+            ";
+            var engine = new Engine();
+            engine.Execute(code);
+        }
     }
 }
diff --git a/Jint/Native/Array/ArrayInstance.cs b/Jint/Native/Array/ArrayInstance.cs
@@ -648,13 +648,15 @@ private void ConvertToSparse()
 
         internal void EnsureCapacity(uint capacity)
         {
-            if (capacity <= MaxDenseArrayLength && capacity > (uint) _dense.Length)
+            if (capacity > MaxDenseArrayLength || _dense is null || capacity <= (uint) _dense.Length)
             {
-                // need to grow
-                var newArray = new PropertyDescriptor[capacity];
-                System.Array.Copy(_dense, newArray, _dense.Length);
-                _dense = newArray;
+                return;
             }
+
+            // need to grow
+            var newArray = new PropertyDescriptor[capacity];
+            System.Array.Copy(_dense, newArray, _dense.Length);
+            _dense = newArray;
         }
 
         public IEnumerator<JsValue> GetEnumerator()