Преглед изворни кода

LibJS: Handle OOB access in GenericIndexedPropertyStorage::take_last()

We already do this for the SimpleIndexedPropertyStorage, so for indexed
properties with GenericIndexedPropertyStorage this would previously
crash. Since overwriting the array-like size with a larger value won't
magically insert values at previously unset indices, we need to handle
such an out of bounds access gracefully and just return an empty value.

Fixes #7043.
Linus Groh пре 4 година
родитељ
комит
63e8477a6b
1 измењених фајлова са 2 додато и 1 уклоњено
  1. 2 1
      Userland/Libraries/LibJS/Runtime/IndexedProperties.cpp

+ 2 - 1
Userland/Libraries/LibJS/Runtime/IndexedProperties.cpp

@@ -160,8 +160,9 @@ ValueAndAttributes GenericIndexedPropertyStorage::take_last()
     m_array_size--;
     m_array_size--;
 
 
     auto result = m_sparse_elements.get(m_array_size);
     auto result = m_sparse_elements.get(m_array_size);
+    if (!result.has_value())
+        return {};
     m_sparse_elements.remove(m_array_size);
     m_sparse_elements.remove(m_array_size);
-    VERIFY(result.has_value());
     return result.value();
     return result.value();
 }
 }