From 6547b0b75e278757f4bb88421cdc27cf7b9705df Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Tue, 6 Sep 2022 11:13:31 -0700 Subject: [PATCH] Fixed Object.freeze() with fast arrays. Previously, Object.freeze() failed to freeze the 'length' property of a fast array. --- src/njs_object.c | 13 ++++++++++++- src/test/njs_unit_test.c | 6 ++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/njs_object.c b/src/njs_object.c index c5176146..4c01f0ba 100644 --- a/src/njs_object.c +++ b/src/njs_object.c @@ -1553,7 +1553,9 @@ static njs_int_t njs_object_set_integrity_level(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, njs_index_t level) { + uint32_t length; njs_int_t ret; + njs_array_t *array; njs_value_t *value; njs_lvlhsh_t *hash; njs_object_t *object; @@ -1576,10 +1578,19 @@ njs_object_set_integrity_level(njs_vm_t *vm, njs_value_t *args, } if (njs_is_fast_array(value)) { - ret = njs_array_convert_to_slow_array(vm, njs_array(value)); + array = njs_array(value); + length = array->length; + + ret = njs_array_convert_to_slow_array(vm, array); if (ret != NJS_OK) { return ret; } + + ret = njs_array_length_redefine(vm, value, length); + if (njs_slow_path(ret != NJS_OK)) { + return ret; + } + } object = njs_object(value); diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c index a717f02a..ee7bb2e1 100644 --- a/src/test/njs_unit_test.c +++ b/src/test/njs_unit_test.c @@ -4615,6 +4615,12 @@ static njs_unit_test_t njs_test[] = { njs_str("Object.prototype[1] = 1; Object.prototype.length = 2; Array.prototype.pop.call({0:0})"), njs_str("1") }, + { njs_str("var a = []; Object.freeze(a); Object.getOwnPropertyDescriptor(a, 'length').writable"), + njs_str("false") }, + + { njs_str("var o = Object.freeze([0,1,2]); o.length=3"), + njs_str("TypeError: Cannot assign to read-only property \"length\" of array") }, + { njs_str("var o = Object.freeze({0: 0, 1: 1, length: 2}); Array.prototype.pop.call(o)"), njs_str("TypeError: Cannot delete property \"1\" of object") }, -- 2.47.3