Fixed Array.prototype.concat() with exotic argument object.

The issue was introduced in 2c1382bab643.

diff --git a/src/njs_array.c b/src/njs_array.c
index 61e0d29e2f739caae3cb4425b9345a27efd8b57d..7e81d6c6a03556b92d44f0d228a7f7980793c790 100644 (file)
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -1743,7 +1743,7 @@ njs_array_prototype_concat(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                 return NJS_ERROR;
             }
 
-            if (njs_is_fast_array(e)) {
+            if (njs_is_fast_array(e) || njs_fast_object(len)) {
                 for (k = 0; k < len; k++, length++) {
                     ret = njs_value_property_i64(vm, e, k, &retval);
                     if (njs_slow_path(ret != NJS_OK)) {

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 3cf81b582df43c88d6da9dfea40b2476fca83684..f2792ef9f5b443a69614a27b8a5167d553968990 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -12857,6 +12857,13 @@ static njs_unit_test_t  njs_test[] =
               "a.concat(b)"),
       njs_str("1,2,3,4,5") },
 
+    { njs_str("Boolean.prototype.length = 2;"
+              "Boolean.prototype[0] = 'a';"
+              "Boolean.prototype[1] = 'b';"
+              "Boolean.prototype[Symbol.isConcatSpreadable] = true;"
+              "[].concat(new Boolean(true))"),
+      njs_str("a,b") },
+
     { njs_str("var o = {}, n = 5381 /* NJS_DJB_HASH_INIT */;"
               "while(n--) o[Symbol()] = 'test'; o[''];"),
       njs_str("undefined") },