diff --git a/lib/Runtime/Library/JavascriptArray.cpp b/lib/Runtime/Library/JavascriptArray.cpp index 075316f8ad5..1064cf1f4ec 100644 --- a/lib/Runtime/Library/JavascriptArray.cpp +++ b/lib/Runtime/Library/JavascriptArray.cpp @@ -9402,9 +9402,8 @@ using namespace Js; } else { - Assert(fromVal < MaxArrayLength); - Assert(toVal < MaxArrayLength); - Assert(direction == -1 || (fromVal + count < MaxArrayLength && toVal + count < MaxArrayLength)); + Assert(direction != -1 || (fromVal < MaxArrayLength && toVal < MaxArrayLength)); + Assert(fromVal + count <= MaxArrayLength && toVal + count <= MaxArrayLength); uint32 fromIndex = static_cast(fromVal); uint32 toIndex = static_cast(toVal); diff --git a/test/es6/ES6ArrayAPI_slow.js b/test/es6/ES6ArrayAPI_slow.js new file mode 100644 index 00000000000..81167810c31 --- /dev/null +++ b/test/es6/ES6ArrayAPI_slow.js @@ -0,0 +1,20 @@ +//------------------------------------------------------------------------------------------------------- +// Copyright (C) Microsoft. All rights reserved. +// Copyright (c) ChakraCore Project Contributors. All rights reserved. +// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information. +//------------------------------------------------------------------------------------------------------- + +WScript.LoadScriptFile("..\\UnitTestFramework\\UnitTestFramework.js"); + +const uint32Max = 4294967295; +const tests = [ + { + name: "Issue #6770 (Assertion failure in copyWithin)", + body() { + const array = []; + array.length = uint32Max; + array.copyWithin(); + } + } +]; +testRunner.runTests(tests, { verbose: WScript.Arguments[0] != "summary" }); diff --git a/test/es6/rlexe.xml b/test/es6/rlexe.xml index a1c7fbab7ea..09d97efd302 100644 --- a/test/es6/rlexe.xml +++ b/test/es6/rlexe.xml @@ -466,6 +466,13 @@ -ES6ObjectLiterals -args summary -endargs + + + ES6ArrayAPI_slow.js + -ES6ObjectLiterals -args summary -endargs + Slow + + ES6ArrayUseConstructor.js