From 745ffca580fb7780fb37cfe6a175ce019277e78a Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Fri, 6 Nov 2020 22:49:36 +0000
Subject: [PATCH] LibJS: Use element index as key for array spread in object

This fixes spreading of arrays with holes in object literals where the
inserted keys are not consecutive numbers.

Fixes #3967.
---
 Libraries/LibJS/AST.cpp                | 2 +-
 Libraries/LibJS/Tests/object-spread.js | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/Libraries/LibJS/AST.cpp b/Libraries/LibJS/AST.cpp
index b40b87e1f0..0a68b154c8 100644
--- a/Libraries/LibJS/AST.cpp
+++ b/Libraries/LibJS/AST.cpp
@@ -1552,7 +1552,7 @@ Value ObjectExpression::execute(Interpreter& interpreter, GlobalObject& global_o
             if (key.is_array()) {
                 auto& array_to_spread = static_cast<Array&>(key.as_object());
                 for (auto& entry : array_to_spread.indexed_properties()) {
-                    object->indexed_properties().append(entry.value_and_attributes(&array_to_spread).value);
+                    object->indexed_properties().put(object, entry.index(), entry.value_and_attributes(&array_to_spread).value);
                     if (interpreter.exception())
                         return {};
                 }
diff --git a/Libraries/LibJS/Tests/object-spread.js b/Libraries/LibJS/Tests/object-spread.js
index 11b33dfad5..93008a8352 100644
--- a/Libraries/LibJS/Tests/object-spread.js
+++ b/Libraries/LibJS/Tests/object-spread.js
@@ -53,6 +53,11 @@ test("spread array in object literal", () => {
     testObjStrSpread(obj);
 });
 
+test("spread array with holes in object literal", () => {
+    const obj = { ...[, , "a", , , , "b", "c", , "d", , ,] };
+    expect(obj).toEqual({ 2: "a", 6: "b", 7: "c", 9: "d" });
+});
+
 test("spread string object in object literal", () => {
     const obj = { ...String("abcd") };
     testObjStrSpread(obj);