LibJS: Handle OOB access in GenericIndexedPropertyStorage::take_last()

We already do this for the SimpleIndexedPropertyStorage, so for indexed
properties with GenericIndexedPropertyStorage this would previously
crash. Since overwriting the array-like size with a larger value won't
magically insert values at previously unset indices, we need to handle
such an out of bounds access gracefully and just return an empty value.

Fixes .
This commit is contained in:
Linus Groh 2021-05-17 23:20:29 +01:00
parent c15121fef7
commit 63e8477a6b
Notes: sideshowbarker 2024-07-18 17:53:53 +09:00

View file

@ -160,8 +160,9 @@ ValueAndAttributes GenericIndexedPropertyStorage::take_last()
m_array_size--;
auto result = m_sparse_elements.get(m_array_size);
if (!result.has_value())
return {};
m_sparse_elements.remove(m_array_size);
VERIFY(result.has_value());
return result.value();
}