From 0bb66890c8881118b86a0b77c0541676594142e6 Mon Sep 17 00:00:00 2001 From: Linus Groh Date: Wed, 4 Nov 2020 23:31:47 +0000 Subject: [PATCH] LibJS: Fix Object::delete_property() with numeric string property - We have to check if the property name is a string before calling as_string() on it - We can't as_number() the same property name but have to use the parsed index number Fixes #3950. --- Libraries/LibJS/Runtime/Object.cpp | 9 ++++++--- Libraries/LibJS/Tests/operators/delete-basic.js | 3 +++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/Libraries/LibJS/Runtime/Object.cpp b/Libraries/LibJS/Runtime/Object.cpp index d3313a1827..9bf6f1376f 100644 --- a/Libraries/LibJS/Runtime/Object.cpp +++ b/Libraries/LibJS/Runtime/Object.cpp @@ -631,9 +631,12 @@ Value Object::delete_property(const PropertyName& property_name) if (property_name.is_number()) return Value(m_indexed_properties.remove(property_name.as_number())); - int property_index = property_name.as_string().to_int().value_or(-1); - if (property_index >= 0) - return Value(m_indexed_properties.remove(property_name.as_number())); + + if (property_name.is_string()) { + i32 property_index = property_name.as_string().to_int().value_or(-1); + if (property_index >= 0) + return Value(m_indexed_properties.remove(property_index)); + } auto metadata = shape().lookup(property_name.to_string_or_symbol()); if (!metadata.has_value()) diff --git a/Libraries/LibJS/Tests/operators/delete-basic.js b/Libraries/LibJS/Tests/operators/delete-basic.js index eb1796cfae..e619e711a2 100644 --- a/Libraries/LibJS/Tests/operators/delete-basic.js +++ b/Libraries/LibJS/Tests/operators/delete-basic.js @@ -46,6 +46,9 @@ test("deleting array indices", () => { expect(a.hasOwnProperty(1)).toBeFalse(); expect(a.hasOwnProperty(2)).toBeFalse(); expect(Object.getOwnPropertyNames(a)).toHaveLength(1); + + expect(delete a["42"]).toBeTrue(); + expect(Object.getOwnPropertyNames(a)).toHaveLength(1); }); test("deleting non-configurable property", () => {