LibJS: Avoid out-of-range double to integer conversion UB

[tcl3]

See individual commits for details.

[tcl3]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

Array, string, and typed array built-ins now explicitly handle extreme indices and overflow boundaries. Regression tests cover out-of-range access, search offsets, repeat counts, and typed array target offsets.

Changes

Built-in index and overflow handling

Layer / File(s)	Summary
Extreme indexed access handling Libraries/LibJS/Runtime/ArrayPrototype.cpp, Libraries/LibJS/Runtime/StringPrototype.cpp, Libraries/LibJS/Runtime/TypedArrayPrototype.cpp, Tests/LibJS/Runtime/builtins/Array/Array.prototype.at.js, Tests/LibJS/Runtime/builtins/String/String.prototype.at.js, Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.at.js	at implementations use double-based index calculations and explicit bounds checks, with tests for very large positive and negative indices.
Out-of-range search start handling Libraries/LibJS/Runtime/ArrayPrototype.cpp, Libraries/LibJS/Runtime/TypedArrayPrototype.cpp, Tests/LibJS/Runtime/builtins/Array/Array.prototype.indexOf.js, Tests/LibJS/Runtime/builtins/Array/Array.prototype.lastIndexOf.js, Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.includes.js, Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.indexOf.js	Search methods return early for out-of-range fromIndex values before unsigned conversion, with corresponding regression tests.
Repeat and target offset overflow boundaries Libraries/LibJS/Runtime/StringPrototype.cpp, Libraries/LibJS/Runtime/TypedArrayPrototype.cpp, Tests/LibJS/Runtime/builtins/String/String.prototype.repeat.js, Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.set.js	Overflow checks now reject oversized string repeat counts and typed array target offsets, with additional RangeError assertions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: awesomekling

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description is related to the change but is too vague to convey any meaningful details.	Replace it with a brief summary of the affected LibJS index and range-check fixes.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Libraries/LibJS/Runtime/TypedArrayPrototype.cpp`:
- Around line 1480-1483: Update both helper paths around the target offset
validation to also reject values greater than NumericLimits<size_t>::max()
before any static_cast<size_t>(target_offset). Preserve the existing
MAX_ARRAY_LIKE_INDEX check and RangeError behavior, ensuring 32-bit builds
cannot narrow an otherwise valid ECMAScript index unsafely.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1bb4573f-06f2-446f-a690-c8aec9c9a96a

📥 Commits

Reviewing files that changed from the base of the PR and between ee1ff63 and 96718f2.

📒 Files selected for processing (4)

• Libraries/LibJS/Runtime/StringPrototype.cpp
• Libraries/LibJS/Runtime/TypedArrayPrototype.cpp
• Tests/LibJS/Runtime/builtins/String/String.prototype.repeat.js
• Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.set.js

🚧 Files skipped from review as they are similar to previous changes (3)

• Tests/LibJS/Runtime/builtins/String/String.prototype.repeat.js
• Libraries/LibJS/Runtime/StringPrototype.cpp
• Tests/LibJS/Runtime/builtins/TypedArray/TypedArray.prototype.set.js