[Webkit-unassigned] [Bug 244196] New: String.prototype.includes should return true when the first parameter is empty regardless of whether the second parameter is greater than length.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=244196

            Bug ID: 244196
           Summary: String.prototype.includes should return true when the
                    first parameter is empty regardless of whether the
                    second parameter is greater than length.
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

function foo(n) {
    return ("aaa").includes("", n)
}
noInline(foo);
for (var m = 0; m < 200; ++m) {
  print(foo(m));
}

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=1

According to ECMAScript Language Specification, when the first parameter of String.prototype.includes is empty, the result should be true regardless of whether the second parameter is greater than length. However, JSC prints false when n exceeds length.

The problem is in StringPrototype.cpp stringIncluesImpl. When positionArg is Int32, it should be clamped. Otherwise, the function findCommon will return notFound and the final result will be false.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220822/caf40c7e/attachment.htm>