Fixed Object.freeze() with fast arrays.

Previously, Object.freeze() failed to freeze the 'length' property of a fast array.

diff --git a/src/njs_object.c b/src/njs_object.c
index c517614606d60d7ccd4f20e9c1c39b7c00263e8a..4c01f0ba7c529b9742ed76f93b1b689778657821 100644 (file)
--- a/src/njs_object.c
+++ b/src/njs_object.c
@@ -1553,7 +1553,9 @@ static njs_int_t
 njs_object_set_integrity_level(njs_vm_t *vm, njs_value_t *args,
     njs_uint_t nargs, njs_index_t level)
 {
+    uint32_t           length;
     njs_int_t          ret;
+    njs_array_t        *array;
     njs_value_t        *value;
     njs_lvlhsh_t       *hash;
     njs_object_t       *object;
@@ -1576,10 +1578,19 @@ njs_object_set_integrity_level(njs_vm_t *vm, njs_value_t *args,
     }
 
     if (njs_is_fast_array(value)) {
-        ret = njs_array_convert_to_slow_array(vm, njs_array(value));
+        array = njs_array(value);
+        length = array->length;
+
+        ret = njs_array_convert_to_slow_array(vm, array);
         if (ret != NJS_OK) {
             return ret;
         }
+
+        ret = njs_array_length_redefine(vm, value, length);
+        if (njs_slow_path(ret != NJS_OK)) {
+            return ret;
+        }
+
     }
 
     object = njs_object(value);

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index a717f02a875298ef09481fc9c41638a53ee2fcad..ee7bb2e140f5e7483257bb0b7d486825303e4d59 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -4615,6 +4615,12 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("Object.prototype[1] = 1; Object.prototype.length = 2; Array.prototype.pop.call({0:0})"),
       njs_str("1") },
 
+    { njs_str("var a = []; Object.freeze(a); Object.getOwnPropertyDescriptor(a, 'length').writable"),
+      njs_str("false") },
+
+    { njs_str("var o = Object.freeze([0,1,2]); o.length=3"),
+      njs_str("TypeError: Cannot assign to read-only property \"length\" of array") },
+
     { njs_str("var o = Object.freeze({0: 0, 1: 1, length: 2}); Array.prototype.pop.call(o)"),
       njs_str("TypeError: Cannot delete property \"1\" of object") },