RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 15:48:12 +00:00
Code Issues Activity Actions

LibJS: Don't assume value for index < size in IndexedPropertyIterator

Browse source 
This assumption only works for the m_packed_elements Vector where a
missing value at a certain index still returns an empty value, but not
for the m_sparse_elements HashMap, which is being used for indices
>= 200 - in that case the Optional<ValueAndAttributes> result will not
have a value.

This fixes a crash in the js REPL where printing an array with a hole at
any index >= 200 would crash.
This commit is contained in:
Linus Groh 2020-10-14 00:22:58 +02:00 • committed by Andreas Kling
parent a1029738fd
commit e07490ce13
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibJS/Runtime/IndexedProperties.cpp
View file

@ -262,7 +262,7 @@ bool IndexedPropertyIterator::operator!=(const IndexedPropertyIterator& other) c
ValueAndAttributes IndexedPropertyIterator::value_and_attributes(Object* this_object, bool evaluate_accessors)
{
if (m_index < m_indexed_properties.array_like_size())
return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value();
return m_indexed_properties.get(this_object, m_index, evaluate_accessors).value_or({});
return {};
}