@@ -33946,6 +33946,8 @@ static __exception int js_parse_function_decl2(JSParseState *s,
3394633946 goto fail;
3394733947 }
3394833948 if (fd->has_parameter_expressions) {
33949+ if (js_parse_check_duplicate_parameter(s, name))
33950+ goto fail;
3394933951 if (define_var(s, fd, name, JS_VAR_DEF_LET) < 0)
3395033952 goto fail;
3395133953 }
@@ -38455,7 +38457,9 @@ static JSValue *build_arg_list(JSContext *ctx, uint32_t *plen,
3845538457 if (js_get_length32(ctx, &len, array_arg))
3845638458 return NULL;
3845738459 if (len > JS_MAX_LOCAL_VARS) {
38458- JS_ThrowInternalError(ctx, "too many arguments");
38460+ // XXX: check for stack overflow?
38461+ JS_ThrowRangeError(ctx, "too many arguments in function call (only %d allowed)",
38462+ JS_MAX_LOCAL_VARS);
3845938463 return NULL;
3846038464 }
3846138465 /* avoid allocating 0 bytes */
@@ -39219,7 +39223,7 @@ static JSValue js_array_with(JSContext *ctx, JSValueConst this_val,
3921939223 idx = len + idx;
3922039224
3922139225 if (idx < 0 || idx >= len) {
39222- JS_ThrowRangeError(ctx, "out of bound" );
39226+ JS_ThrowRangeError(ctx, "invalid array index: %" PRId64, idx );
3922339227 goto exception;
3922439228 }
3922539229
@@ -41840,7 +41844,7 @@ static JSValue js_string_includes(JSContext *ctx, JSValueConst this_val,
4184041844 ret = js_is_regexp(ctx, argv[0]);
4184141845 if (ret) {
4184241846 if (ret > 0)
41843- JS_ThrowTypeError(ctx, "regex not supported");
41847+ JS_ThrowTypeError(ctx, "regexp not supported");
4184441848 goto fail;
4184541849 }
4184641850 v = JS_ToString(ctx, argv[0]);
@@ -42402,7 +42406,7 @@ static JSValue js_string_pad(JSContext *ctx, JSValueConst this_val,
4240242406 }
4240342407 }
4240442408 if (n > JS_STRING_LEN_MAX) {
42405- JS_ThrowInternalError (ctx, "string too long ");
42409+ JS_ThrowRangeError (ctx, "invalid string length ");
4240642410 goto fail2;
4240742411 }
4240842412 if (string_buffer_init(ctx, b, n))
@@ -42464,8 +42468,9 @@ static JSValue js_string_repeat(JSContext *ctx, JSValueConst this_val,
4246442468 len = p->len;
4246542469 if (len == 0 || n == 1)
4246642470 return str;
42471+ // XXX: potential arithmetic overflow
4246742472 if (val * len > JS_STRING_LEN_MAX) {
42468- JS_ThrowInternalError (ctx, "string too long ");
42473+ JS_ThrowRangeError (ctx, "invalid string length ");
4246942474 goto fail;
4247042475 }
4247142476 if (string_buffer_init2(ctx, b, n * len, p->is_wide_char))
@@ -52728,11 +52733,13 @@ void JS_AddIntrinsicBaseObjects(JSContext *ctx)
5272852733 JS_NewGlobalCConstructor2(ctx, obj1,
5272952734 "Error", ctx->class_proto[JS_CLASS_ERROR]);
5273052735
52736+ /* Used to squelch a -Wcast-function-type warning. */
52737+ JSCFunctionType ft = { .generic_magic = js_error_constructor };
5273152738 for(i = 0; i < JS_NATIVE_ERROR_COUNT; i++) {
5273252739 JSValue func_obj;
5273352740 int n_args;
5273452741 n_args = 1 + (i == JS_AGGREGATE_ERROR);
52735- func_obj = JS_NewCFunction3(ctx, (JSCFunction *)js_error_constructor ,
52742+ func_obj = JS_NewCFunction3(ctx, ft.generic ,
5273652743 native_error_name[i], n_args,
5273752744 JS_CFUNC_constructor_or_func_magic, i, obj1);
5273852745 JS_NewGlobalCConstructor2(ctx, func_obj, native_error_name[i],
@@ -53518,7 +53525,7 @@ static JSValue js_typed_array_with(JSContext *ctx, JSValueConst this_val,
5351853525 if (idx < 0)
5351953526 idx = len + idx;
5352053527 if (idx < 0 || idx >= len)
53521- return JS_ThrowRangeError(ctx, "out of bound ");
53528+ return JS_ThrowRangeError(ctx, "invalid array index ");
5352253529
5352353530 val = JS_ToPrimitive(ctx, argv[1], HINT_NUMBER);
5352453531 if (JS_IsException(val))
@@ -55855,6 +55862,8 @@ void JS_AddIntrinsicTypedArrays(JSContext *ctx)
5585555862 countof(js_typed_array_base_funcs));
5585655863 JS_SetConstructor(ctx, typed_array_base_func, typed_array_base_proto);
5585755864
55865+ /* Used to squelch a -Wcast-function-type warning. */
55866+ JSCFunctionType ft = { .generic_magic = js_typed_array_constructor };
5585855867 for(i = JS_CLASS_UINT8C_ARRAY; i < JS_CLASS_UINT8C_ARRAY + JS_TYPED_ARRAY_COUNT; i++) {
5585955868 JSValue func_obj;
5586055869 char buf[ATOM_GET_STR_BUF_SIZE];
@@ -55867,7 +55876,7 @@ void JS_AddIntrinsicTypedArrays(JSContext *ctx)
5586755876 0);
5586855877 name = JS_AtomGetStr(ctx, buf, sizeof(buf),
5586955878 JS_ATOM_Uint8ClampedArray + i - JS_CLASS_UINT8C_ARRAY);
55870- func_obj = JS_NewCFunction3(ctx, (JSCFunction *)js_typed_array_constructor ,
55879+ func_obj = JS_NewCFunction3(ctx, ft.generic ,
5587155880 name, 3, JS_CFUNC_constructor_magic, i,
5587255881 typed_array_base_func);
5587355882 JS_NewGlobalCConstructor2(ctx, func_obj, name, ctx->class_proto[i]);
0 commit comments