Creation of arrays with negative lengths?

[jerviscui]

runtime/src/libraries/System.Private.CoreLib/src/System/Threading/ThreadPoolWorkQueue.cs

Line 138 in 2b60d82

var newArray = new object?[m_array.Length << 1];

I have a problem where a continuous left shift goes negative, and the code throws an exception.
Am I missing something?

[En3Tho]

How do you even end up having 2 billion work items in the first place?

Are you just pushing more and more items in an endless loop or something?

Expanding an array more and more won't help you as it is a clear indication of a bug in your code

[huoyaoyuan]

Trying to create array of negative length will throw an exception. It's a safe behavior for handling exceptional cases.

[dotnet-policy-service]

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

[huoyaoyuan]

How do you even end up having 2 billion work items in the first place?

Security-wise, it's still important to get exceptionally large content correctly rejected, instead of causing security issues like buffer overrun.

[EgorBo]

@jerviscui is the question basically "how can m_array.Length << 1 produce a negative value"? if so, just run this:

byte[] arr = new byte[1_100_000_000];
Console.WriteLine(arr.Length << 1);

[dotnet-policy-service]

This issue has been marked needs-author-action and may be missing some important information.

[sfiruch]

var newArray = new object?[m_array.Length << 1];
I have a problem where a continuous left shift goes negative, and the code throws an exception. Am I missing something?

m_array.Length is a signed integer. The most-significant bit of a signed integer specifies whether the integer represents a positive or negative number.

If you start with a very large signed integer, which has the second-most-significant-bit set, the left-shift will shift that bit into the most-significant position. This then represents a negative number, because the most-significant bit is set.

This is expected behavior. I don't think it's an issue/bug in .NET.