LibJS: Reject a repeat count of 2^64 in String.prototype.repeat

Author: tcl3

Libraries/LibJS/Runtime/StringPrototype.cpp

@@ -824,7 +824,7 @@ JS_DEFINE_NATIVE_FUNCTION(StringPrototype::repeat)
     if (string->is_empty())
         return PrimitiveString::create(vm, Utf16String {});
 
-    if (n > static_cast<double>(NumericLimits<size_t>::max()))
+    if (n >= static_cast<double>(NumericLimits<size_t>::max()))
         return vm.throw_completion<RangeError>(ErrorType::StringRepeatCountMustNotOverflow);
 
     auto count = static_cast<size_t>(n);

Tests/LibJS/Runtime/builtins/String/String.prototype.repeat.js

@@ -30,6 +30,10 @@ test("throws correct range errors", () => {
     expect(() => {
         "aa".repeat(0x80000000);
     }).toThrowWithMessage(RangeError, "repeat count must not overflow");
+
+    expect(() => {
+        "foo".repeat(2 ** 64);
+    }).toThrowWithMessage(RangeError, "repeat count must not overflow");
 });
 
 test("UTF-16", () => {