From 7e7c1ac7688d089915754ba5c6ccee227ffb2961 Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Wed, 17 May 2023 00:39:45 -0700 Subject: [PATCH] Fixed evaluation of computed property names with function expressions. Previously, while evaluating a property name expression with a function expression as the right side, the evaluation modified the value used to compute the property name in-place. The in-place modification changes values not intended to be changed. The issue was introduced in 74d30c2d70f3 (0.7.8). This fixes #640 issue on Github. --- src/njs_generator.c | 13 +++++++++++++ src/test/njs_unit_test.c | 3 +++ 2 files changed, 16 insertions(+) diff --git a/src/njs_generator.c b/src/njs_generator.c index 3b45f4ef..b8f4e44d 100644 --- a/src/njs_generator.c +++ b/src/njs_generator.c @@ -3247,6 +3247,12 @@ njs_generate_assignment_end(njs_vm_t *vm, njs_generator_t *generator, njs_generate_code(generator, njs_vmcode_2addr_t, to_prop_key, NJS_VMCODE_TO_PROPERTY_KEY, 2, property); + prop_index = njs_generate_temp_index_get(vm, generator, + property); + if (njs_slow_path(prop_index == NJS_INDEX_ERROR)) { + return NJS_ERROR; + } + to_prop_key->src = property->index; to_prop_key->dst = prop_index; @@ -3277,6 +3283,13 @@ njs_generate_assignment_end(njs_vm_t *vm, njs_generator_t *generator, prop_set->object = object->index; prop_set->property = prop_index; + if (prop_index != property->index) { + ret = njs_generate_index_release(vm, generator, prop_index); + if (njs_slow_path(ret != NJS_OK)) { + return ret; + } + } + node->index = expr->index; node->temporary = expr->temporary; diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c index 05d79830..aca3a520 100644 --- a/src/test/njs_unit_test.c +++ b/src/test/njs_unit_test.c @@ -3922,6 +3922,9 @@ static njs_unit_test_t njs_test[] = { njs_str("var named = Symbol('xxx'); ({[named]: () => {}})[named].name"), njs_str("[xxx]") }, + { njs_str("var obj = {}; ({[obj](){}}); typeof obj"), + njs_str("object") }, + { njs_str("var called = false;" "({" " [{toString(){ if (called) throw 'OOps'; called = true; return 'a'}}](){}" -- 2.47.3