0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibJS: Fix impossible member access for negative integers

Browse source 
The PropertyName class able to match a number or an array can only
accept positive numerical values. However, the computed_property_name
method sometimes returned negative values.

This commit also adds a basic object access test case.
This commit is contained in:
DexesTTP 2020-04-06 21:21:11 +02:00 • committed by Andreas Kling
parent cb18b2c74d
commit 4a9485f830
Notes: sideshowbarker 2024-07-19 07:50:36 +09:00
2 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibJS/AST.cpp
View file

@ -893,7 +893,7 @@ PropertyName MemberExpression::computed_property_name(Interpreter& interpreter)
return {};
ASSERT(!index.is_empty());
// FIXME: What about non-integer numbers tho.
if (index.is_number())
if (index.is_number() && index.to_i32() >= 0)
return PropertyName(index.to_i32());
return PropertyName(index.to_string());
}

17
Libraries/LibJS/Tests/object-basic.js Normal file
View file

@ -0,0 +1,17 @@
try {
var o = { foo: "bar" };
assert(o.foo === "bar");
assert(o["foo"] === "bar");
o.baz = "test";
assert(o.baz === "test");
assert(o["baz"] === "test");
o[10] = "123";
assert(o[10] === "123");
assert(o["10"] === "123");
o[-1] = "hello friends";
assert(o[-1] === "hello friends");
assert(o["-1"] === "hello friends");
console.log("PASS");
} catch (e) {
console.log("FAIL: " + e);
}