mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-05-03 01:38:52 +00:00
0603402c80
This fixes Array.prototype.{join,toString}() crashing with arrays
containing themselves, i.e. circular references.
The spec is suspiciously silent about this, and indeed engine262, a
"100% spec compliant" ECMA-262 implementation, can't handle these cases.
I had a look at some major engines instead and they all seem to keep
track or check for circular references and return an empty string for
already seen objects.
- SpiderMonkey: "AutoCycleDetector detector(cx, obj)"
- V8: "CycleProtectedArrayJoin<JSArray>(...)"
- JavaScriptCore: "StringRecursionChecker checker(globalObject, thisObject)"
- ChakraCore: "scriptContext->CheckObject(thisArg)"
To keep things simple & consistent this uses the same pattern as
JSONObject, MarkupGenerator and js: simply putting each seen object in a
HashTable<Object*>.
Fixes #3929.
|
||
|---|---|---|
| .. | ||
| array-basic.js | ||
| array-length-setter.js | ||
| array-shrink-during-find-crash.js | ||
| array-simple-and-generic-storage-initialization.js | ||
| array-spread.js | ||
| Array.from.js | ||
| Array.isArray.js | ||
| Array.js | ||
| Array.of.js | ||
| Array.prototype-generic-functions.js | ||
| Array.prototype.concat.js | ||
| Array.prototype.every.js | ||
| Array.prototype.fill.js | ||
| Array.prototype.filter.js | ||
| Array.prototype.find.js | ||
| Array.prototype.findIndex.js | ||
| Array.prototype.forEach.js | ||
| Array.prototype.includes.js | ||
| Array.prototype.indexOf.js | ||
| Array.prototype.join.js | ||
| Array.prototype.lastIndexOf.js | ||
| Array.prototype.map.js | ||
| Array.prototype.pop.js | ||
| Array.prototype.push.js | ||
| Array.prototype.reduce.js | ||
| Array.prototype.reduceRight.js | ||
| Array.prototype.reverse.js | ||
| Array.prototype.shift.js | ||
| Array.prototype.slice.js | ||
| Array.prototype.some.js | ||
| Array.prototype.splice.js | ||
| Array.prototype.toLocaleString.js | ||
| Array.prototype.toString.js | ||
| Array.prototype.unshift.js | ||
| Array.prototype.values.js | ||