208639 2020-03-05 06:21:08 -0800 an issue about Array.prototype.lastIndexOf 2020-03-24 09:40:32 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build PC Linux RESOLVED DUPLICATE 163417 InRadar P2 Normal --- 1 958268052 webkit-unassigned ashvayka fpizlo keith_miller webkit-bug-importer ysuzuki oldest_to_newest 1626039 0 958268052 2020-03-05 06:21:08 -0800 Description: According to ES10, the method Array.prototype.lastIndexOf() returns the last index at which a given element can be found in the array, or -1 if it is not present.When the array's length is 4294967296, it will take a long time to find the element because the array is searched backwards. But the engine actually did not, it returned soonly. From ES6.0, the standard uses "ToLength" to deal with the property "length" not "ToUint32". JavaScriptCore doesn't meet this request. Version:b96bf75 https://github.com/WebKit/webkit/commit/b96bf7590bc090fa8161cff1189255ca3319c94b Build steps: Tools/Scripts/build-webkit --debug --jsc-only -j Testcase: var NISLFuzzingFunc = function() { var obj = { 0:12, length:4294967296 }; Array.prototype.lastIndexOf.call(obj, 12); }; NISLFuzzingFunc(); Execution steps: webkit/WebKitBuild/Debug/bin/jsc testcase.js 1626355 1 webkit-bug-importer 2020-03-05 15:56:57 -0800 <rdar://problem/60104993> 1633354 2 ashvayka 2020-03-24 09:40:32 -0700 Thank you for detailed report. Apart from Array.prototype.lastIndexOf, other Array methods (mostly ones that are implemented in C++) are affected. I am merging all bug reports to fix all (observable) cases with a single patch. *** This bug has been marked as a duplicate of bug 163417 ***