Nico Weber 1b944b4c41 LibJS: Fix substr() with negative arguments larger than string length ...

length_in_code_units() returns a size_t, which is 64-bit unsigned
in i686 builds. `size + (i32)int_length` hence produced a 64-bit
unsigned result, so a negative value would wrap around and become
a very large number.

As fix, just omit the cast -- we assign the result of max() to
a double anyways.

With this, all test262 tests in annexB/built-ins/String/prototype pass.

2022-01-14 11:12:24 +01:00

..

String.fromCharCode.js

…

String.fromCodePoint.js

…

String.js

…

String.prototype-generic-functions.js

…

String.prototype.at.js

…

String.prototype.charAt.js

…

String.prototype.charCodeAt.js

…

String.prototype.codePointAt.js

…

String.prototype.concat.js

…

String.prototype.endsWith.js

…

String.prototype.includes.js

…

String.prototype.indexOf.js

…

String.prototype.js

…

String.prototype.lastIndexOf.js

…

String.prototype.localeCompare.js

…

String.prototype.match.js

…

String.prototype.matchAll.js

…

String.prototype.padEnd.js

…

String.prototype.padStart.js

…

String.prototype.repeat.js

…

String.prototype.replace.js

…

String.prototype.replaceAll.js

…

String.prototype.search.js

…

String.prototype.slice.js

…

String.prototype.split.js

…

String.prototype.startsWith.js

…

String.prototype.substr.js

…

String.prototype.substring.js

…

String.prototype.toLocaleLowerCase.js

…

String.prototype.toLocaleUpperCase.js

…

String.prototype.toLowerCase.js

…

String.prototype.toString.js

…

String.prototype.toUpperCase.js

…

String.prototype.trim.js

…

String.prototype.valueOf.js

…

String.raw.js

…