Fixed processing of large array indexes.

diff --git a/njs/njs_vm.c b/njs/njs_vm.c
index 02498350b0f7c29db3f805b00025f1f6f0cc916d..6d4deaf350f269ccdde84a1e7611e217b79508d2 100644 (file)
--- a/njs/njs_vm.c
+++ b/njs/njs_vm.c
@@ -73,7 +73,7 @@ struct njs_property_next_s {
 static nxt_noinline njs_ret_t njs_property_query(njs_vm_t *vm,
     njs_property_query_t *pq, njs_value_t *object, njs_value_t *property);
 static njs_ret_t njs_array_property_query(njs_vm_t *vm,
-    njs_property_query_t *pq, njs_value_t *object, int32_t index);
+    njs_property_query_t *pq, njs_value_t *object, uint32_t index);
 static njs_ret_t njs_object_property_query(njs_vm_t *vm,
     njs_property_query_t *pq, njs_value_t *value, njs_object_t *object);
 static njs_ret_t njs_method_private_copy(njs_vm_t *vm,
@@ -1054,21 +1054,22 @@ njs_property_query(njs_vm_t *vm, njs_property_query_t *pq, njs_value_t *object,
 
 static njs_ret_t
 njs_array_property_query(njs_vm_t *vm, njs_property_query_t *pq,
-    njs_value_t *object, int32_t index)
+    njs_value_t *object, uint32_t index)
 {
-    int32_t      size;
+    uint32_t     size;
     njs_ret_t    ret;
     njs_value_t  *value;
     njs_array_t  *array;
 
     array = object->data.u.array;
-    size = index - array->length;
 
-    if (size >= 0) {
+    if (index >= array->length) {
         if (pq->query != NJS_PROPERTY_QUERY_SET) {
             return NXT_DECLINED;
         }
 
+        size = index - array->length;
+
         ret = njs_array_expand(vm, array, 0, size + 1);
         if (nxt_slow_path(ret != NXT_OK)) {
             return ret;

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index f8005c58f9555f61cf8713d318a0394580d62b41..5aa70512b03242a95d22ad70596cd41e882923d6 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -2487,6 +2487,9 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("var a = [ 1, 2, 3 ]; a[4294967296] = 4; a + a[4294967296]"),
       nxt_string("1,2,34") },
 
+    { nxt_string("delete[]['4e9']"),
+      nxt_string("false") },
+
     { nxt_string("var n = 1, a = [ n += 1 ]; a"),
       nxt_string("2") },