瀏覽代碼

LibJS: Don't assume value for index < size in IndexedPropertyIterator

This assumption only works for the m_packed_elements Vector where a
missing value at a certain index still returns an empty value, but not
for the m_sparse_elements HashMap, which is being used for indices
>= 200 - in that case the Optional<ValueAndAttributes> result will not
have a value.

This fixes a crash in the js REPL where printing an array with a hole at
any index >= 200 would crash.
Linus Groh 4 年之前
父節點
當前提交
e07490ce13
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      Libraries/LibJS/Runtime/IndexedProperties.cpp

+ 1 - 1
Libraries/LibJS/Runtime/IndexedProperties.cpp

@@ -262,7 +262,7 @@ bool IndexedPropertyIterator::operator!=(const IndexedPropertyIterator& other) c
 ValueAndAttributes IndexedPropertyIterator::value_and_attributes(Object* this_object, bool evaluate_accessors)
 {
     if (m_index < m_indexed_properties.array_like_size())
-        return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value();
+        return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value_or({});
     return {};
 }