JS: fix bounds checking (Issue 23123)

* For ByteArray-based bounds-checking, the JavaScript backend must use the
`len` field, instead of the inbuild JavaScript `length` field.

* Range-based operations must also check both the start and end of the range
for bounds

* All indicies are valid for ranges of size zero, since they are essentially no-ops

* For cases of ByteArray accesses (e.g. read as Int), the end index is
(i * sizeof(type) + sizeof(type) - 1), while the previous implementation
uses (i + sizeof(type) - 1). In the Int32 example, this is (i * 4 + 3)

* IndexByteArrayOp_Word8As* primitives use byte array indicies (unlike
the previous point), but now check both start and end indicies

* Byte array copies now check if the arrays are the same by identity and
then if the ranges overlap.

1 files changed, 12 insertions, 0 deletions

diff --git a/rts/js/mem.js b/rts/js/mem.js
index 2f91b80798..73e6f9aecd 100644
--- a/rts/js/mem.js
+++ b/rts/js/mem.js
@@ -1455,3 +1455,15 @@ function h$pext64(src_b, src_a, mask_b, mask_a) {
  }
  RETURN_UBX_TUP2(dst_b, dst_a);
 }
+
+function h$checkOverlapByteArray(a1, o1, a2, o2, n) {
+  if (n == 0) return true;
+  if (a1 == a2) {
+    if (o1 < o2) {
+      return o1 + n - 1 < o2;
+    } else {
+      return o2 + n - 1 < o1;
+    }
+  }
+  return true;
+}