From f80c3adf07bd4e087b6441954ed0d829241680a8 Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Tue, 18 Jan 2022 15:35:00 +0000 Subject: [PATCH] Fixed Array.prototype.concat() with exotic argument object. The issue was introduced in 2c1382bab643. --- src/njs_array.c | 2 +- src/test/njs_unit_test.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/src/njs_array.c b/src/njs_array.c index 61e0d29e..7e81d6c6 100644 --- a/src/njs_array.c +++ b/src/njs_array.c @@ -1743,7 +1743,7 @@ njs_array_prototype_concat(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, return NJS_ERROR; } - if (njs_is_fast_array(e)) { + if (njs_is_fast_array(e) || njs_fast_object(len)) { for (k = 0; k < len; k++, length++) { ret = njs_value_property_i64(vm, e, k, &retval); if (njs_slow_path(ret != NJS_OK)) { diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c index 3cf81b58..f2792ef9 100644 --- a/src/test/njs_unit_test.c +++ b/src/test/njs_unit_test.c @@ -12857,6 +12857,13 @@ static njs_unit_test_t njs_test[] = "a.concat(b)"), njs_str("1,2,3,4,5") }, + { njs_str("Boolean.prototype.length = 2;" + "Boolean.prototype[0] = 'a';" + "Boolean.prototype[1] = 'b';" + "Boolean.prototype[Symbol.isConcatSpreadable] = true;" + "[].concat(new Boolean(true))"), + njs_str("a,b") }, + { njs_str("var o = {}, n = 5381 /* NJS_DJB_HASH_INIT */;" "while(n--) o[Symbol()] = 'test'; o[''];"), njs_str("undefined") }, -- 2.47.3