From 4a9485f830c1134177cbd066fdeb24458d1ec4d0 Mon Sep 17 00:00:00 2001 From: DexesTTP Date: Mon, 6 Apr 2020 21:21:11 +0200 Subject: LibJS: Fix impossible member access for negative integers The PropertyName class able to match a number or an array can only accept positive numerical values. However, the computed_property_name method sometimes returned negative values. This commit also adds a basic object access test case. --- Libraries/LibJS/AST.cpp | 2 +- Libraries/LibJS/Tests/object-basic.js | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 Libraries/LibJS/Tests/object-basic.js diff --git a/Libraries/LibJS/AST.cpp b/Libraries/LibJS/AST.cpp index bb6eb6f8d0..5f96c5f6d9 100644 --- a/Libraries/LibJS/AST.cpp +++ b/Libraries/LibJS/AST.cpp @@ -893,7 +893,7 @@ PropertyName MemberExpression::computed_property_name(Interpreter& interpreter) return {}; ASSERT(!index.is_empty()); // FIXME: What about non-integer numbers tho. - if (index.is_number()) + if (index.is_number() && index.to_i32() >= 0) return PropertyName(index.to_i32()); return PropertyName(index.to_string()); } diff --git a/Libraries/LibJS/Tests/object-basic.js b/Libraries/LibJS/Tests/object-basic.js new file mode 100644 index 0000000000..9be713008c --- /dev/null +++ b/Libraries/LibJS/Tests/object-basic.js @@ -0,0 +1,17 @@ +try { + var o = { foo: "bar" }; + assert(o.foo === "bar"); + assert(o["foo"] === "bar"); + o.baz = "test"; + assert(o.baz === "test"); + assert(o["baz"] === "test"); + o[10] = "123"; + assert(o[10] === "123"); + assert(o["10"] === "123"); + o[-1] = "hello friends"; + assert(o[-1] === "hello friends"); + assert(o["-1"] === "hello friends"); + console.log("PASS"); +} catch (e) { + console.log("FAIL: " + e); +} \ No newline at end of file -- cgit v1.2.3