mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-04 15:19:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibJS: Fix Object::delete_property() with numeric string property

Browse source 
- We have to check if the property name is a string before calling
  as_string() on it
- We can't as_number() the same property name but have to use the parsed
  index number

Fixes #3950.
This commit is contained in:
Linus Groh 2020-11-04 23:31:47 +00:00 • committed by Andreas Kling
commit 0bb66890c8
Notes: sideshowbarker 2024-07-19 01:32:50 +09:00
2 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Libraries/LibJS/Runtime/Object.cpp
View file

@ -631,9 +631,12 @@ Value Object::delete_property(const PropertyName& property_name)
if (property_name.is_number())
return Value(m_indexed_properties.remove(property_name.as_number()));
int property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_name.as_number()));
if (property_name.is_string()) {
i32 property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_index));
}
auto metadata = shape().lookup(property_name.to_string_or_symbol());
if (!metadata.has_value())