From e07490ce137a079dc3faebdc6387ed983cc912ff Mon Sep 17 00:00:00 2001 From: Linus Groh Date: Wed, 14 Oct 2020 00:22:58 +0200 Subject: [PATCH] LibJS: Don't assume value for index < size in IndexedPropertyIterator This assumption only works for the m_packed_elements Vector where a missing value at a certain index still returns an empty value, but not for the m_sparse_elements HashMap, which is being used for indices >= 200 - in that case the Optional result will not have a value. This fixes a crash in the js REPL where printing an array with a hole at any index >= 200 would crash. --- Libraries/LibJS/Runtime/IndexedProperties.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Libraries/LibJS/Runtime/IndexedProperties.cpp b/Libraries/LibJS/Runtime/IndexedProperties.cpp index 65bbc6a89b..12538bf075 100644 --- a/Libraries/LibJS/Runtime/IndexedProperties.cpp +++ b/Libraries/LibJS/Runtime/IndexedProperties.cpp @@ -262,7 +262,7 @@ bool IndexedPropertyIterator::operator!=(const IndexedPropertyIterator& other) c ValueAndAttributes IndexedPropertyIterator::value_and_attributes(Object* this_object, bool evaluate_accessors) { if (m_index < m_indexed_properties.array_like_size()) - return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value(); + return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value_or({}); return {}; }