From a7d03d91439e68ce4bc7e92bf225abe768d53d40 Mon Sep 17 00:00:00 2001
From: Igor Sysoev <igor@sysoev.ru>
Date: Fri, 14 Oct 2016 17:21:35 +0300
Subject: [PATCH] A fix in Array.splice() function.

---
 njs/njs_array.c          | 4 ++++
 njs/test/njs_unit_test.c | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/njs/njs_array.c b/njs/njs_array.c
index 4a10ded2..39bdfa61 100644
--- a/njs/njs_array.c
+++ b/njs/njs_array.c
@@ -585,6 +585,10 @@ njs_array_prototype_splice(njs_vm_t *vm, njs_value_t *args, nxt_uint_t nargs,
         if (nargs > 1) {
             start = args[1].data.u.number;
 
+            if (start > array->length) {
+                start = array->length;
+            }
+
             if (nargs > 2) {
                 delete = args[2].data.u.number;
 
diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index 59663e4e..22f647f8 100644
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -2304,6 +2304,10 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("var a = []; a.splice()"),
       nxt_string("") },
 
+    { nxt_string("var a = [];"
+                 "a.splice(9,0,1,2).join(':') + '|' + a"),
+      nxt_string("|1,2") },
+
     { nxt_string("var a = [0,1,2,3,4,5,6,7];"
                  "a.splice(3).join(':') + '|' + a"),
       nxt_string("3:4:5:6:7|0,1,2") },
-- 
2.47.3