Fixed Array.prototype.join() with TypeArray instance.

Found by Clang static analyzer.
The issue was introduced in ccfa84cea2b3.

diff --git a/src/njs_array.c b/src/njs_array.c
index 918103e0069bfcb06773cd7696e225a65a98ebd3..6f2559b0c34d8069caf6afeb7aff5e89c3112586 100644 (file)
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -1609,7 +1609,8 @@ njs_array_prototype_join(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
     njs_chb_init(&chain, vm->mem_pool);
 
     for (i = 0; i < len; i++) {
-        if (njs_fast_path(njs_object(this)->fast_array
+        if (njs_fast_path(array != NULL
+                          && array->object.fast_array
                           && njs_is_valid(&array->start[i])))
         {
             value = &array->start[i];

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 6146fdd852a8201870736ae678b4956b8ec6b8e3..d0b7e567396b142057b84e3ea4ced89bb6148a1d 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -3973,13 +3973,21 @@ static njs_unit_test_t  njs_test[] =
       njs_str(",,,false,true,0,1") },
 
     { njs_str("var o = { toString: function() { return null } };"
-                 "[o].join()"),
+              "[o].join()"),
       njs_str("null") },
 
     { njs_str("var o = { toString: function() { return undefined } };"
-                 "[o].join()"),
+              "[o].join()"),
       njs_str("undefined") },
 
+    { njs_str("var a = [0,,2,3];"
+              "Object.defineProperty(Array.prototype, 1, {get: ()=> {a[32] = 32; return 1}, configurable:true});"
+              "a.join()"),
+    njs_str("0,1,2,3") },
+
+    { njs_str("Array.prototype.join.call(new Uint8Array([0,1,2]))"),
+      njs_str("0,1,2") },
+
     { njs_str("var a = []; a[5] = 5; a"),
       njs_str(",,,,,5") },