beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-22 07:30:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibJS: Don't create "valid" PropertyName from null string

Browse source 
When value.to_string() throws an exception it returns a null string in
which case we must not construct a valid PropertyName.

Also ASSERT in PropertyName(String) and PropertyName(FlyString) to
prevent this from happening in the future.

Fixes #3941.
This commit is contained in:
Linus Groh 2020-11-04 09:48:48 +00:00 committed by Andreas Kling
parent 8afe1c8165
commit 41837f548d
Notes: sideshowbarker 2024-07-19 01:34:01 +09:00 
Author: https://github.com/linusg
Commit: https://github.com/SerenityOS/serenity/commit/41837f548df
Pull-request: https://github.com/SerenityOS/serenity/pull/3943
Issue: https://github.com/SerenityOS/serenity/issues/3941
2 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
Libraries/LibJS/Runtime/PropertyName.h
View file

@ -48,7 +48,10 @@ public:
return &value.as_symbol();
if (value.is_integer() && value.as_i32() >= 0)
return value.as_i32();
return value.to_string(global_object);
auto string = value.to_string(global_object);
if (string.is_null())
return {};
return string;
}
PropertyName() { }
@ -70,18 +73,21 @@ public:
: m_type(Type::String)
, m_string(FlyString(string))
{
ASSERT(!string.is_null());
}
PropertyName(const FlyString& string)
: m_type(Type::String)
, m_string(string)
{
ASSERT(!string.is_null());
}
PropertyName(Symbol* symbol)
: m_type(Type::Symbol)
, m_symbol(symbol)
{
ASSERT(symbol);
}
PropertyName(const StringOrSymbol& string_or_symbol)

11
Libraries/LibJS/Tests/computed-property-throws.js
View file

@ -6,3 +6,14 @@ test("Issue #3459, exception in computed property expression", () => {
"foo"[bar]();
}).toThrow(ReferenceError);
});
test("Issue #3941, exception in computed property's toString()", () => {
expect(() => {
const o = {
toString() {
throw Error();
},
};
"foo"[o];
}).toThrow(Error);
});