Use ToLength for the argument list length in apply

[fhgffy]

build_arg_list() read the length of the array-like with ToUint32, so f.apply(null, { length: -1 }) threw "RangeError: too many arguments in function call" and a length like 2 ** 32 + 1 wrapped around to 1. CreateListFromArrayLike goes through LengthOfArrayLike (ToLength), which clamps negative values to 0. The same helper backs Reflect.apply and Reflect.construct, so those are fixed too.

The length is now read with js_get_length64() and checked against the argument limit before narrowing. With the patch:

function f() { return arguments.length }
f.apply(null, { length: -1 })          // 0
Reflect.apply(f, null, { length: -1 }) // 0
f.apply(null, { length: 2 ** 32 + 1 }) // RangeError instead of calling f with one argument

Added cases to test_function in tests/test_builtin.js (they fail without the change). make test passes and make test262 shows no change against test262_errors.txt.

Fixes #1764

[bnoordhuis]

LGTM and good catch but this suggests to me that we should either:

• change js_get_length32 so it clamps values instead of wrapping, or
• excise it from the code base altogether