RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 06:58:11 +00:00
Code Issues Activity Actions

LibJS: Fix Object::delete_property() with numeric string property

Browse source 
- We have to check if the property name is a string before calling
  as_string() on it
- We can't as_number() the same property name but have to use the parsed
  index number

Fixes #3950.
This commit is contained in:
Linus Groh 2020-11-04 23:31:47 +00:00 • committed by Andreas Kling
parent 8d96f428ef
commit 0bb66890c8
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Libraries/LibJS/Runtime/Object.cpp
View file

@ -631,9 +631,12 @@ Value Object::delete_property(const PropertyName& property_name)
if (property_name.is_number())
return Value(m_indexed_properties.remove(property_name.as_number()));
int property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_name.as_number()));
if (property_name.is_string()) {
i32 property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_index));
}
auto metadata = shape().lookup(property_name.to_string_or_symbol());
if (!metadata.has_value())