diff --git a/Libraries/LibJS/Runtime/ArrayPrototype.cpp b/Libraries/LibJS/Runtime/ArrayPrototype.cpp index 0437a0a5fe..39117d4c50 100644 --- a/Libraries/LibJS/Runtime/ArrayPrototype.cpp +++ b/Libraries/LibJS/Runtime/ArrayPrototype.cpp @@ -27,6 +27,7 @@ */ #include +#include #include #include #include @@ -39,6 +40,8 @@ namespace JS { +static HashTable s_array_join_seen_objects; + ArrayPrototype::ArrayPrototype(GlobalObject& global_object) : Object(*global_object.object_prototype()) { @@ -316,6 +319,13 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayPrototype::join) auto* this_object = vm.this_value(global_object).to_object(global_object); if (!this_object) return {}; + + // This is not part of the spec, but all major engines do some kind of circular reference checks. + // FWIW: engine262, a "100% spec compliant" ECMA-262 impl, aborts with "too much recursion". + if (s_array_join_seen_objects.contains(this_object)) + return js_string(vm, ""); + s_array_join_seen_objects.set(this_object); + auto length = get_length(vm, *this_object); if (vm.exception()) return {}; @@ -339,6 +349,9 @@ JS_DEFINE_NATIVE_FUNCTION(ArrayPrototype::join) return {}; builder.append(string); } + + s_array_join_seen_objects.remove(this_object); + return js_string(vm, builder.to_string()); } diff --git a/Libraries/LibJS/Tests/builtins/Array/Array.prototype.join.js b/Libraries/LibJS/Tests/builtins/Array/Array.prototype.join.js index dcaf733d63..30efb7e2b5 100644 --- a/Libraries/LibJS/Tests/builtins/Array/Array.prototype.join.js +++ b/Libraries/LibJS/Tests/builtins/Array/Array.prototype.join.js @@ -14,3 +14,11 @@ test("basic functionality", () => { expect([1, null, 2, undefined, 3].join()).toBe("1,,2,,3"); expect(Array(3).join()).toBe(",,"); }); + +test("circular references", () => { + const a = ["foo", [], [1, 2, []], ["bar"]]; + a[1] = a; + a[2][2] = a; + // [ "foo", , [ 1, 2, ], [ "bar" ] ] + expect(a.join()).toBe("foo,,1,2,,bar"); +});