RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 13:28:11 +00:00
Code Issues Activity Actions

LibJS: Fix impossible member access for negative integers

Browse source 
The PropertyName class able to match a number or an array can only
accept positive numerical values. However, the computed_property_name
method sometimes returned negative values.

This commit also adds a basic object access test case.
This commit is contained in:
DexesTTP 2020-04-06 21:21:11 +02:00 • committed by Andreas Kling
parent cb18b2c74d
commit 4a9485f830
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibJS/AST.cpp
View file

@ -893,7 +893,7 @@ PropertyName MemberExpression::computed_property_name(Interpreter& interpreter)
return {};
ASSERT(!index.is_empty());
// FIXME: What about non-integer numbers tho.
if (index.is_number())
if (index.is_number() && index.to_i32() >= 0)
return PropertyName(index.to_i32());
return PropertyName(index.to_string());
}