diff --git a/Libraries/LibJS/Runtime/ArrayPrototype.cpp b/Libraries/LibJS/Runtime/ArrayPrototype.cpp index b3ac9b7928..0cd228cf6a 100644 --- a/Libraries/LibJS/Runtime/ArrayPrototype.cpp +++ b/Libraries/LibJS/Runtime/ArrayPrototype.cpp @@ -441,6 +441,9 @@ Value ArrayPrototype::find(Interpreter& interpreter) auto array_size = array->elements().size(); for (size_t i = 0; i < array_size; ++i) { + if (i >= array->elements().size()) + break; + auto value = array->elements().at(i); if (value.is_empty()) continue; @@ -475,6 +478,9 @@ Value ArrayPrototype::find_index(Interpreter& interpreter) auto array_size = array->elements().size(); for (size_t i = 0; i < array_size; ++i) { + if (i >= array->elements().size()) + break; + auto value = array->elements().at(i); if (value.is_empty()) continue; diff --git a/Libraries/LibJS/Tests/array-shrink-during-find-crash.js b/Libraries/LibJS/Tests/array-shrink-during-find-crash.js new file mode 100644 index 0000000000..656eab3e80 --- /dev/null +++ b/Libraries/LibJS/Tests/array-shrink-during-find-crash.js @@ -0,0 +1,25 @@ +load("test-common.js"); + +try { + var a, callbackCalled; + + callbackCalled = 0; + a = [1, 2, 3, 4, 5]; + a.find(() => { + callbackCalled++; + a.pop(); + }); + assert(callbackCalled === 3); + + callbackCalled = 0; + a = [1, 2, 3, 4, 5]; + a.findIndex(() => { + callbackCalled++; + a.pop(); + }); + assert(callbackCalled === 3); + + console.log("PASS"); +} catch (e) { + console.log("FAIL: " + e); +}