A fix in Array.slice() function.

diff --git a/njs/njs_array.c b/njs/njs_array.c
index de5d9e6c6a6552751452ead125bd671954592e2c..4a10ded2e3ec2f364d92d5c01d6f48057ffb54c8 100644 (file)
--- a/njs/njs_array.c
+++ b/njs/njs_array.c
@@ -387,21 +387,29 @@ njs_array_prototype_slice(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
                 }
             }
 
-            end = length;
+            if (start >= length) {
+                start = 0;
+                length = 0;
 
-            if (nargs > 2) {
-                end = args[2].data.u.number;
+            } else {
+                end = length;
+
+                if (nargs > 2) {
+                    end = args[2].data.u.number;
 
-                if (end < 0) {
-                    end += length;
+                    if (end < 0) {
+                        end += length;
+                    }
                 }
-            }
 
-            length = end - start;
+                if (length >= end) {
+                    length = end - start;
 
-            if (length < 0) {
-                start = 0;
-                length = 0;
+                    if (length < 0) {
+                        start = 0;
+                        length = 0;
+                    }
+                }
             }
         }
     }

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 5ee74d0bc88fb0e9b13c504cdab287d8a860978f..59663e4e9d71fd3967cee489dd16d66c07b0c72e 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -2260,6 +2260,24 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("a = [1,2]; a[100] = 100; a[100] +' '+ a.length"),
       nxt_string("100 101") },
 
+    { nxt_string("Array.prototype.slice(1)"),
+      nxt_string("") },
+
+    { nxt_string("Array.prototype.slice(1,2)"),
+      nxt_string("") },
+
+    { nxt_string("Array.prototype.pop()"),
+      nxt_string("undefined") },
+
+    { nxt_string("Array.prototype.shift()"),
+      nxt_string("undefined") },
+
+    { nxt_string("[0,1,2,3,4].slice(1,4)"),
+      nxt_string("1,2,3") },
+
+    { nxt_string("[0,1,2,3,4].slice(6,7)"),
+      nxt_string("") },
+
     { nxt_string("a = [1,2,3,4,5]; b = a.slice(3); b[0] +' '+ b[1] +' '+ b[2]"),
       nxt_string("4 5 undefined") },