immutable-js
diff --git a/‎__tests__/List.ts‎
Lines changed: 49 additions & 0 deletions b/‎__tests__/List.ts‎
Lines changed: 49 additions & 0 deletions
diff --git a/‎src/List.js‎
Lines changed: 48 additions & 2 deletions b/‎src/List.js‎
Lines changed: 48 additions & 2 deletions
@@ -913,6 +913,55 @@ describe('List', () => {
     });
   });
 
+  // A List addresses its values through a 32-wide trie using signed 32-bit
+  // bitwise math. Sizes/indices at or beyond 2 ** 30 used to overflow that math:
+  // the level-raising loop spun forever, hanging an empty List and OOM-crashing
+  // (SIGABRT) a populated one, while `setSize` silently wrapped large values.
+  // All of these must now throw a clear, catchable RangeError.
+  describe('rejects out-of-range sizes instead of hanging / crashing', () => {
+    const tooBig = 2 ** 30;
+
+    it('throws (does not hang) when setting a too-large index on an empty List', () => {
+      expect(() => List().set(tooBig, 'x')).toThrow(RangeError);
+    });
+
+    it('throws (does not OOM-crash) when setting a too-large index on a populated List', () => {
+      const list = List(arrayOfSize(64));
+      expect(() => list.set(tooBig, 'x')).toThrow(RangeError);
+    });
+
+    it('throws for a numeric-string index coming through a setIn key path', () => {
+      const state = fromJS({ items: arrayOfSize(64) });
+      expect(() => state.setIn(['items', '1073741824'], 'x')).toThrow(
+        RangeError
+      );
+    });
+
+    it('throws on setSize beyond the max rather than silently truncating', () => {
+      // Previously returned size 0 and size 5 respectively.
+      expect(() => List([1, 2, 3]).setSize(2 ** 31)).toThrow(RangeError);
+      expect(() => List([1, 2, 3]).setSize(2 ** 32 + 5)).toThrow(RangeError);
+    });
+
+    it('still allows operations within the addressable range', () => {
+      expect(List([1, 2, 3]).setSize(1500).size).toBe(1500);
+      expect(List([1, 2, 3]).set(5, 'x').size).toBe(6);
+      // Largest in-range size is accepted by the bounds math (sparse, no alloc).
+      expect(List([1, 2, 3]).setSize(tooBig).size).toBe(tooBig);
+    });
+
+    it('handles a large in-range negative index without hanging', () => {
+      // Exercises the deep-tree origin-normalization path (the `2 ** exp`
+      // fallback). Must terminate rather than spin forever; the existing values
+      // are shifted to the end of the grown List.
+      const result = List([1, 2, 3]).set(-(2 ** 29), 'x');
+      expect(result.size).toBe(2 ** 29);
+      expect(result.get(result.size - 3)).toBe(1);
+      expect(result.get(result.size - 2)).toBe(2);
+      expect(result.get(result.size - 1)).toBe(3);
+    });
+  });
+
   it('Does not infinite loop when sliced with NaN #459', () => {
     const list = List([1, 2, 3, 4, 5]);
     const newList = list.slice(0, NaN);
 
@@ -526,7 +526,39 @@ function listNodeFor(list, rawIndex) {
   }
 }
 
+/**
+ * Validates requested bounds before int32 coercion in setListBounds().
+ * Throws when origin/capacity would exceed the trie's safe range.
+ */
+function validateListBoundsRequest(list, begin, end) {
+  const requestedOrigin = list._origin + (begin === undefined ? 0 : begin);
+  const requestedCapacity =
+    end === undefined
+      ? list._capacity
+      : end < 0
+        ? list._capacity + end
+        : list._origin + end;
+
+  // Keep origin/capacity within the trie's safe signed 32-bit range.
+  if (
+    (Number.isFinite(requestedCapacity) && requestedCapacity > MAX_LIST_SIZE) ||
+    (Number.isFinite(requestedOrigin) && requestedOrigin < -MAX_LIST_SIZE) ||
+    (Number.isFinite(requestedCapacity) &&
+      Number.isFinite(requestedOrigin) &&
+      requestedCapacity - requestedOrigin > MAX_LIST_SIZE)
+  ) {
+    throw new RangeError(
+      'Invalid List size: a List cannot hold more than ' +
+        MAX_LIST_SIZE +
+        ' (2 ** 30) values.'
+    );
+  }
+}
+
 function setListBounds(list, begin, end) {
+  // Validate full-precision bounds before int32 coercion.
+  validateListBoundsRequest(list, begin, end);
+
   // Sanitize begin & end using this shorthand for ToInt32(argument)
   // http://www.ecma-international.org/ecma-262/6.0/#sec-toint32
   if (begin !== undefined) {
@@ -565,7 +597,8 @@ function setListBounds(list, begin, end) {
       owner
     );
     newLevel += SHIFT;
-    offsetShift += 1 << newLevel;
+    // Shift origin into non-negative space as trie height grows.
+    offsetShift += levelCapacity(newLevel);
   }
   if (offsetShift) {
     newOrigin += offsetShift;
@@ -578,7 +611,7 @@ function setListBounds(list, begin, end) {
   const newTailOffset = getTailOffset(newCapacity);
 
   // New size might need creating a higher root.
-  while (newTailOffset >= 1 << (newLevel + SHIFT)) {
+  while (newTailOffset >= levelCapacity(newLevel + SHIFT)) {
     newRoot = new VNode(
       newRoot && newRoot.array.length ? [newRoot] : [],
       owner
@@ -675,3 +708,16 @@ function setListBounds(list, begin, end) {
 function getTailOffset(size) {
   return size < SIZE ? 0 : ((size - 1) >>> SHIFT) << SHIFT;
 }
+
+// The largest number of values a List can hold. Above this the 32-bit trie math
+// in setListBounds() stays in the safe signed 32-bit range.
+const MAX_LIST_SIZE = 2 ** 30; // 1073741824
+
+/**
+ * Computes 2 ** exp for the trie level-raising loops in setListBounds().
+ * Use the cheap bitwise operator shift whenever possible, otherwise fall back to exponentiation.
+ * This is necessary because bitwise operators in JavaScript only work on 32-bit signed integers, so for exp >= 31, we need to use exponentiation to avoid overflow.
+ */
+function levelCapacity(exp) {
+  return exp < 31 ? 1 << exp : 2 ** exp;
+}