LibJS: Fix impossible member access for negative integers

The PropertyName class able to match a number or an array can only
accept positive numerical values. However, the computed_property_name
method sometimes returned negative values.

This commit also adds a basic object access test case.

2 files changed, 18 insertions, 1 deletions

diff --git a/Libraries/LibJS/AST.cpp b/Libraries/LibJS/AST.cpp
index bb6eb6f8d0..5f96c5f6d9 100644
--- a/Libraries/LibJS/AST.cpp
+++ b/Libraries/LibJS/AST.cpp
@@ -893,7 +893,7 @@ PropertyName MemberExpression::computed_property_name(Interpreter& interpreter)
         return {};
     ASSERT(!index.is_empty());
     // FIXME: What about non-integer numbers tho.
-    if (index.is_number())
+    if (index.is_number() && index.to_i32() >= 0)
         return PropertyName(index.to_i32());
     return PropertyName(index.to_string());
 }
diff --git a/Libraries/LibJS/Tests/object-basic.js b/Libraries/LibJS/Tests/object-basic.js
new file mode 100644
index 0000000000..9be713008c
--- /dev/null
+++ b/Libraries/LibJS/Tests/object-basic.js
@@ -0,0 +1,17 @@
+try {
+    var o = { foo: "bar" };
+    assert(o.foo === "bar");
+    assert(o["foo"] === "bar");
+    o.baz = "test";
+    assert(o.baz === "test");
+    assert(o["baz"] === "test");
+    o[10] = "123";
+    assert(o[10] === "123");
+    assert(o["10"] === "123");
+    o[-1] = "hello friends";
+    assert(o[-1] === "hello friends");
+    assert(o["-1"] === "hello friends");
+    console.log("PASS");
+} catch (e) {
+    console.log("FAIL: " + e);
+}
\ No newline at end of file