According to ES10.0，TypedArray(length) uses method ToIndex to avoid negative length. So the length of the array can not be negative. But when the parameter of Float64Array is -268435457 or smaller, the length of array is changed into a negative number. And other TypedArray constructors also have similar situation. Rhino achieves TypedArray(length) but doesn't handle negative length properly. This may be an issue of TypedArray constructors' parameter judgment.

version

1.7.12

command

java -jar rhino/rhino-1.7.12.jar -debug -version 200 testcase.js

testcase

var NISLFuzzingFunc = function(){
	var array = new Float64Array(-268435457);
        print(array.length);
};
NISLFuzzingFunc();

output

-268435457

expected output

RangeError:Negative array length

Contributor:@YuanWangC