A fix in Array.splice() function.

diff --git a/njs/njs_array.c b/njs/njs_array.c
index 4a10ded2e3ec2f364d92d5c01d6f48057ffb54c8..39bdfa618752df2cd70b449afa8dde24eb15d669 100644 (file)
--- a/njs/njs_array.c
+++ b/njs/njs_array.c
@@ -585,6 +585,10 @@ njs_array_prototype_splice(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
         if (nargs > 1) {
             start = args[1].data.u.number;
 
+            if (start > array->length) {
+                start = array->length;
+            }
+
             if (nargs > 2) {
                 delete = args[2].data.u.number;
 

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 59663e4e9d71fd3967cee489dd16d66c07b0c72e..22f647f82c9edc44650a0cc5f7ad60bfc0701524 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -2304,6 +2304,10 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("var a = []; a.splice()"),
       nxt_string("") },
 
+    { nxt_string("var a = [];"
+                 "a.splice(9,0,1,2).join(':') + '|' + a"),
+      nxt_string("|1,2") },
+
     { nxt_string("var a = [0,1,2,3,4,5,6,7];"
                  "a.splice(3).join(':') + '|' + a"),
       nxt_string("3:4:5:6:7|0,1,2") },