add check against length for memset

MikeHolman · pleath · commit f61ea1c3b20e · 2016-02-12T10:44:24.000-08:00
diff --git a/lib/Runtime/Library/TypedArray.h b/lib/Runtime/Library/TypedArray.h
@@ -331,6 +331,12 @@ namespace Js
                 // fixup the length with the change
                 newLength += start;
             }
+            if (newStart >= GetLength())
+            {
+                // If we want to start copying past the length of the array, all index are no-op
+                return true;
+            }
+
             if (UInt32Math::Add(newStart, newLength) > GetLength())
             {
                 newLength = GetLength() - newStart;
diff --git a/test/typedarray/memset_neg.js b/test/typedarray/memset_neg.js
@@ -0,0 +1,15 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function foo() {
+  var a = new Int8Array(500);
+  for(var i = 500; i < 1000; ++i) {
+    a[i] = 0;
+  }
+}
+
+foo();
+foo();
+WScript.Echo("PASSED");
diff --git a/test/typedarray/rlexe.xml b/test/typedarray/rlexe.xml
@@ -304,6 +304,12 @@ Below test fails with difference in space. Investigate the cause and re-enable t
       <compile-flags>-mic:1 -off:simplejit -off:JITLoopBody -mmoc:0</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>memset_neg.js</files>
+      <compile-flags>-mic:1 -off:simplejit -bgjit- -mmoc:0</compile-flags>
+    </default>
+  </test>
   <test>
     <default>
       <files>memcopy.js</files>

Original file line number	Diff line number	Diff line change
`@@ -331,6 +331,12 @@ namespace Js`
`331`	`331`	`// fixup the length with the change`
`332`	`332`	`newLength += start;`
`333`	`333`	`}`
	`334`	`+ if (newStart >= GetLength())`
	`335`	`+ {`
	`336`	`+ // If we want to start copying past the length of the array, all index are no-op`
	`337`	`+ return true;`
	`338`	`+ }`
	`339`	`+`
`334`	`340`	`if (UInt32Math::Add(newStart, newLength) > GetLength())`
`335`	`341`	`{`
`336`	`342`	`newLength = GetLength() - newStart;`