浏览代码

LibJS: Handle OOB access in GenericIndexedPropertyStorage::take_last()

We already do this for the SimpleIndexedPropertyStorage, so for indexed
properties with GenericIndexedPropertyStorage this would previously
crash. Since overwriting the array-like size with a larger value won't
magically insert values at previously unset indices, we need to handle
such an out of bounds access gracefully and just return an empty value.

Fixes #7043.
Linus Groh 4 年之前
父节点
当前提交
63e8477a6b
共有 1 个文件被更改,包括 2 次插入1 次删除
  1. 2 1
      Userland/Libraries/LibJS/Runtime/IndexedProperties.cpp

+ 2 - 1
Userland/Libraries/LibJS/Runtime/IndexedProperties.cpp

@@ -160,8 +160,9 @@ ValueAndAttributes GenericIndexedPropertyStorage::take_last()
     m_array_size--;
 
     auto result = m_sparse_elements.get(m_array_size);
+    if (!result.has_value())
+        return {};
     m_sparse_elements.remove(m_array_size);
-    VERIFY(result.has_value());
     return result.value();
 }