From 2584ec0b9b6bf919a5c96e4b2659c68a5638bf31 Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Fri, 25 Sep 2026 09:36:01 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=A7=BB=E9=99=A4=20repeat=20=E4=B8=87?=
 =?UTF-8?q?=E7=BA=A7=E9=9D=99=E9=BB=98=E6=88=AA=E6=96=AD=E4=B8=8A=E9=99=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_builtins/src/string/basic.rs | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/crates/oxide_builtins/src/string/basic.rs b/crates/oxide_builtins/src/string/basic.rs
index 7de9e1f3..615a72cb 100644
--- a/crates/oxide_builtins/src/string/basic.rs
+++ b/crates/oxide_builtins/src/string/basic.rs
@@ -614,7 +614,7 @@ pub fn string_trim_end<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     NativeResult::Ok(vm.new_string_units_owned(s[..end].to_vec()))
 }
 
-/// `String.prototype.repeat(count)`：重复字符串 count 次（当前上限 10000 防滥用）。
+/// `String.prototype.repeat(count)`：重复字符串 count 次。
 pub fn string_repeat<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     builtins_debug!("String.prototype.repeat called with {} args", args.len());
     // count 转换先行（&mut 路径）：ToIntegerOrInfinity 传播式，负值与 +Inf
@@ -627,11 +627,20 @@ pub fn string_repeat<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         if p < 0.0 || p.is_infinite() {
             return NativeResult::Err(crate::error::create_range_error(vm, "Invalid count argument"));
         }
-        (p as usize).min(10000)
+        p
     } else {
-        1
+        1.0
     };
     let s = try_string!(this_units(vm, args));
+    // 空串或 0 次直接返回空串（规范步 7），免大 count 下空循环。
+    if s.is_empty() || n == 0.0 {
+        return NativeResult::Ok(vm.new_string_units_owned(Vec::new()));
+    }
+    // 重复后总长超 2^53-1 规范上限抛 RangeError（规范步 9）。
+    if (s.len() as f64) * n > 9007199254740991.0 {
+        return NativeResult::Err(crate::error::create_range_error(vm, "Invalid string length"));
+    }
+    let n = n as usize;
     let mut out = Vec::with_capacity(s.len() * n);
     for _ in 0..n {
         out.extend_from_slice(&s);